last executing test programs: 30.705070786s ago: executing program 0 (id=2352): pipe(&(0x7f0000000180)) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x275a, 0x0) write$cgroup_subtree(r0, &(0x7f0000000100)=ANY=[], 0x32600) mmap(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x2000001, 0x12, r0, 0x0) ioctl$AUTOFS_DEV_IOCTL_REQUESTER(0xffffffffffffffff, 0xc018937b, 0x0) set_mempolicy(0x0, &(0x7f0000000300)=0x7, 0x8000000000000000) r1 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_add_memb(r1, 0x107, 0x1, &(0x7f0000000100)={0x0, 0x2, 0x6, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x39}}, 0x10) setsockopt$packet_drop_memb(r1, 0x107, 0x2, &(0x7f0000000080)={0x0, 0x1, 0x6, @remote}, 0x10) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) r3 = bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0xf, 0xc, &(0x7f0000000740)=ANY=[@ANYBLOB="1800000000000000000000000000000085000000610000001801000020786c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b7030000110b0008850000007500000095"], &(0x7f0000000500)='GPL\x00', 0x7, 0x0, 0x0, 0x0, 0x1, '\x00', 0x0, @cgroup_device, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='blkio.bfq.dequeue\x00', 0x26e1, 0x0) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000080)={r3, 0x18000000000002a0, 0xcc0, 0x0, &(0x7f0000000140)="06ff03076844268cb89e14f00800", 0x0, 0x0, 0x60000000, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x50) sendmsg$NFT_BATCH(r2, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000000c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a44000000090a010400000000000000000700000008000a1e000000020073797a39000000000900010073797a3000000000080005400000000c0800064000000000140000001000010000000000000000000084000a000000"], 0x6c}}, 0x0) 30.362307999s ago: executing program 0 (id=2354): syz_open_dev$admmidi(&(0x7f0000000140), 0x20, 0x0) syz_open_dev$admmidi(&(0x7f0000000140), 0x20, 0x0) r0 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000000), 0x80383, 0x0) r1 = syz_io_uring_setup(0xf00, &(0x7f0000000400)={0x0, 0x595f, 0x800, 0x1, 0x51}, &(0x7f0000000100)=0x0, &(0x7f00000000c0)=0x0, &(0x7f0000000080)=0x0) syz_io_uring_submit(r2, r3, r4, &(0x7f0000000280)=@IORING_OP_READV=@use_registered_buffer={0x1, 0x0, 0x4004, @fd_index=0x3, 0x5, 0x0, 0x0, 0x10, 0x0, {0x1, 0x0, 0x0, '\x00', 0x0}}) io_uring_enter(r1, 0x2000, 0xfffffffd, 0x9, 0x0, 0x0) ioctl$SNDCTL_SEQ_RESET(r0, 0x5100) 29.323620907s ago: executing program 0 (id=2357): set_mempolicy(0x6005, &(0x7f0000000080)=0xfffffffffffffffd, 0x4) r0 = syz_open_dev$dri(&(0x7f00000000c0), 0x1ff, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_LEASE(r0, 0xc01864c6, &(0x7f0000000140)={&(0x7f0000000640)=[0x0, 0x0], 0x42af}) 29.006202858s ago: executing program 0 (id=2359): r0 = timerfd_create(0x1, 0x0) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff0000/0x1000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f0000ff8000/0x3000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f000068c000/0xc000)=nil, &(0x7f0000817000/0x1000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x0) r1 = io_uring_setup(0x7, &(0x7f0000000040)={0x0, 0x66ad, 0xc000, 0x1, 0x800000bf}) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x12, 0x3, 0x0, &(0x7f0000000240)='syzkaller\x00', 0x80000000, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="16"], 0x50) io_uring_enter(r1, 0x2219, 0x7721, 0x17, 0x0, 0x0) timerfd_settime(r0, 0x3, &(0x7f0000000040)={{0x77359400}, {0x0, 0x989680}}, 0x0) (fail_nth: 3) 27.964741556s ago: executing program 0 (id=2364): inotify_init1(0x80800) socket$nl_route(0x10, 0x3, 0x0) syz_open_procfs(0x0, &(0x7f0000000240)='clear_refs\x00') open(&(0x7f0000000000)='./file0\x00', 0x80140, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) socket$nl_route(0x10, 0x3, 0x0) openat$ppp(0xffffffffffffff9c, &(0x7f0000001740), 0x101042, 0x0) signalfd4(0xffffffffffffffff, &(0x7f0000000140)={[0xffeffffffffffffa]}, 0x8, 0x800) socket$nl_generic(0x10, 0x3, 0x10) socket(0x10, 0x803, 0x0) syz_open_procfs(0x0, &(0x7f0000000700)='mounts\x00') r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) sendmsg$NL80211_CMD_CONNECT(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000000)=ANY=[@ANYRES32, @ANYRES16=0x0, @ANYRES8=r0], 0x1c}, 0x1, 0x0, 0x0, 0x20000844}, 0x24018807) bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="1400000007"], 0x50) pwrite64(0xffffffffffffffff, &(0x7f0000000000)='L', 0x1, 0x7ffffffe) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r1, &(0x7f0000000040)={0x1f, 0xffff, 0x3}, 0x6) write$binfmt_misc(r1, &(0x7f0000000000), 0xd) 27.517732507s ago: executing program 0 (id=2366): syz_usb_connect$uac1(0x5, 0x72, &(0x7f0000000200)=ANY=[@ANYBLOB="120110010000002082057d004000010203010902600003010048f30904000000010100000a240106000a0002010209040100000102000009040101010102000009050109080000037f072501000200090402000001020000090402010101020000090582094000090603072521e69437c5010409b8a4006ac91719da58f70e3ee65d75626abb36f0c3c45002d487b43a25333c3e17a7be121b85690d4e354f49f2043b231827c573a624a5026e81ed4a2baf3bee123cf7af696f77ee4b25d95e6d38cccb13ccbf50343dbf86b4ed05ac77baa26a3cfbf9000000000000f5ec641e1ed835f8f9cadb1062a0be3c5f"], 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_MD5SIG(r1, 0x6, 0xe, &(0x7f0000000100)={@in6={{0xa, 0x4e20, 0x7, @loopback, 0xc88}}, 0x0, 0x0, 0xa, 0x0, "25c633e7eb9cc056ed394ba71b6e5d7bf4d988ea7c340885973233ddc0946fbd53f014e2854b661b3f9f55a7e67ba35c3537ea83c3817a08930cf99a34dfc5e167b887734921da2397b9cc8b1e235b95"}, 0xd8) bind$inet6(r1, &(0x7f0000000000)={0xa, 0x4e20, 0xfffffffd, @loopback, 0x3681}, 0x1c) syz_usb_connect(0x3, 0x8c6, &(0x7f0000000000)=ANY=[@ANYBLOB="1201500236e47e2082055c2955d4010203010902b408048006a00309047f0e01ff2dde700a24010100000000000824050503"], &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0}) mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1) setsockopt$inet6_tcp_TCP_MD5SIG(r1, 0x6, 0x20, &(0x7f0000000000)={@in={{0x2, 0x4e22, @multicast2}}, 0x0, 0x0, 0x3f, 0x0, "a30b3b68af4d2f246a016542daa845f387713f4048ff2ece1e75f1fc0100f41e4de6256109383664417165bba0dd5ace522fa788000e00000033035551502f07b4001a00"}, 0xd8) r2 = socket$can_bcm(0x1d, 0x2, 0x2) ioctl$ifreq_SIOCGIFINDEX_vcan(r2, 0x8933, &(0x7f0000000100)={'vcan0\x00', 0x0}) connect$can_bcm(r2, &(0x7f0000001ff0)={0x1d, r3}, 0x10) sendmsg$can_raw(r2, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000ff0)={&(0x7f0000000140)=@canfd={{0x1}, 0xf8, 0x0, 0x0, 0x0, "0327e1b22b5fcef7739c699f5ff986ca08990039576a7d5cb2bdac3fa80acf584ecb5fee496e6866856b76b5ee00000000000000004e2f9663a918fa1efd9b0b"}, 0x48}, 0xee, 0x0, 0x0, 0x44041}, 0x84841) connect$inet6(r1, &(0x7f0000000000)={0xa, 0x4e62, 0x1ff, @loopback, 0x23}, 0x1c) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000000)={'bridge0\x00', 0x0}) bpf$MAP_CREATE(0x0, &(0x7f00000008c0)=ANY=[@ANYBLOB='!\x00'], 0x50) sendmsg$nl_route(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000080)=ANY=[@ANYBLOB="2c00000070000100000000000000000007000000", @ANYRES32=r4, @ANYBLOB="14000180080006"], 0x2c}}, 0x0) openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$KVM_CREATE_PIT2(0xffffffffffffffff, 0x4040ae77, 0x0) ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x0) 16.955598415s ago: executing program 3 (id=2411): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f0000000040)={0xa, 0x4e22, 0x0, @empty}, 0x1c) listen(r0, 0x0) syz_emit_ethernet(0x4a, &(0x7f00000004c0)={@local, @empty, @void, {@ipv6={0x86dd, @tcp={0x0, 0x6, "0a8435", 0x14, 0x6, 0x0, @remote, @local, {[], {{0x0, 0x4e22, 0x41424344, 0x41424344, 0x0, 0x0, 0x5, 0x2}}}}}}}, 0x0) syz_emit_ethernet(0x4e, &(0x7f0000000080)={@local, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x3f}, @void, {@ipv6={0x86dd, @tcp={0x0, 0x6, "038c08", 0x18, 0x6, 0xff, @local, @local, {[], {{0x0, 0x4e22, 0x41424344, 0x41424344, 0x0, 0x0, 0x6, 0xc2, 0x0, 0x0, 0x4, {[@mss={0x2, 0x4, 0x8}]}}}}}}}}, 0x0) 16.521684087s ago: executing program 3 (id=2414): sendmsg$IPCTNL_MSG_CT_NEW(0xffffffffffffffff, 0x0, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000000)={0x26, 'hash\x00', 0x0, 0x0, 'cbcmac(aes)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000c18000)="ad56b6c5820fae9d6dcd3292ea54c7beef915d564c90c200", 0x18) r1 = accept4(r0, 0x0, 0x0, 0x800) sendmmsg$alg(r1, &(0x7f0000000400)=[{0x0, 0x0, &(0x7f00000002c0)=[{&(0x7f0000000080)}], 0x1}], 0x1, 0xf0ff) sendmsg$IPSET_CMD_TEST(r1, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000500)={0x0}, 0x1, 0x0, 0x0, 0x40000}, 0x20040080) 16.188317166s ago: executing program 3 (id=2416): syz_open_dev$char_usb(0xc, 0xb4, 0x0) r0 = socket$inet(0x2, 0x80001, 0x84) getsockopt$inet_sctp_SCTP_STREAM_SCHEDULER_VALUE(r0, 0x84, 0xb, &(0x7f0000000140)={0x0, 0x42}, &(0x7f0000000080)=0x4) syz_usb_ep_write(0xffffffffffffffff, 0x81, 0x0, 0x0) r1 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000280), 0x140800, 0x0) r2 = epoll_create1(0x80000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f00000003c0)=@file={0x0, './bus\x00'}, 0x6e) sendmmsg$unix(r4, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) epoll_ctl$EPOLL_CTL_ADD(r2, 0x1, r1, &(0x7f0000000100)={0x20000014}) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) sched_setattr(0x0, &(0x7f0000000180)={0x47, 0x5, 0x8, 0x5, 0x0, 0x9, 0x0, 0x57c73f3a, 0xfa11, 0xffffffff}, 0x0) poll(&(0x7f0000000140)=[{r4, 0x2cfc08c20dafc34e}, {r2, 0xf102}], 0x2, 0x8000007) socket(0x1d, 0x6, 0x6) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) r5 = socket(0x400000000010, 0x3, 0x0) sendmsg$nl_route_sched(r5, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@newqdisc={0x44, 0x24, 0x4ee4e6a52ff56541, 0x70bd29, 0xffffffff, {0x0, 0x0, 0x0, 0x0, {0x0, 0xfff1}, {0xffff, 0xffff}, {0xc, 0xf}}, [@qdisc_kind_options=@q_hfsc={{0x9}, {0x14, 0x2, @TCA_HFSC_RSC={0x10, 0x1, {0x0, 0xfffffffe, 0x4}}}}]}, 0x44}, 0x1, 0x0, 0x0, 0x8801}, 0x20008850) socket(0x400000000010, 0x3, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000003c0)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x2204403c}, 0x0) ioctl$vim2m_VIDIOC_TRY_FMT(0xffffffffffffffff, 0xc0d05640, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000001c0)={0x0}}, 0x0) socket$inet6(0xa, 0x1, 0x8010800000000084) 11.880963387s ago: executing program 3 (id=2432): r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040), 0x4000000044402, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000080)={'pimreg0\x00', 0x7c2}) ioctl$TUNATTACHFILTER(r1, 0x401054d5, &(0x7f0000000040)={0x5, &(0x7f0000000000)=[{0x25, 0x0, 0x3, 0x6a57}, {0x1d}, {0x27, 0x0, 0x89, 0x1}, {0xb1, 0x0, 0x28, 0x6}, {0x16, 0xff, 0x5, 0x557}]}) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x200000e, 0x13, r0, 0x0) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000140)=ANY=[@ANYBLOB="30000000200025a729bd7000fddbdf250a0000cdfe0000010200010008000600fe7f00000c001400", @ANYRES32], 0x30}, 0x1, 0x0, 0x0, 0x20008005}, 0x4c050) r3 = syz_open_dev$sndpcmc(&(0x7f0000000080), 0x0, 0x0) ioctl$AUTOFS_IOC_SETTIMEOUT(r0, 0x80049367, &(0x7f00000000c0)=0x5) r4 = bpf$MAP_CREATE(0x0, &(0x7f0000000200)=@base={0xf, 0x4, 0x4, 0x12}, 0x48) r5 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000440)={0x7, 0xa, &(0x7f0000000680)=ANY=[@ANYBLOB="18080000001d00000000000000000000851000000600000018000000", @ANYRES32, @ANYBLOB="00000000000000002c0000000000000018000000000000000000000000000000950000000000000095"], &(0x7f0000000000)='GPL\x00', 0x4}, 0x94) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f00000003c0)={r5, 0xe0, &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, ""/16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x8, &(0x7f0000001380)}}, 0x10) r6 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000340)={0xe, 0x4, &(0x7f0000000400)=ANY=[@ANYBLOB="18020000801000000000000004000000850000002700000095"], &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x40f00}, 0x94) bpf$BPF_PROG_DETACH(0x8, &(0x7f0000000080)={@map=r4, r6, 0x5}, 0x10) bpf$BPF_PROG_DETACH(0x8, &(0x7f0000000080)=ANY=[], 0x10) mmap(&(0x7f000003d000/0x2000)=nil, 0x2000, 0x3000004, 0x10, r0, 0xfa6e1000) ioctl$SNDRV_PCM_IOCTL_CHANNEL_INFO(r3, 0xc0844123, &(0x7f0000002fc0)) 11.009988806s ago: executing program 2 (id=2438): syz_clone3(&(0x7f0000000540)={0x180801000, &(0x7f00000001c0), 0x0, 0x0, {0x3f}, 0x0, 0x0, 0x0, 0x0}, 0x58) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFNL_MSG_CTHELPER_GET(r0, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000380)=ANY=[@ANYBLOB="180000000109050000000000000000000700000804000200723006af05998c198e09f21b0a2d314df657a1af21bf53c14601a068a93544db868cba1f47750ccf3d2a6da8b852df5c46a78418c2265b84270f1841642ad793fa6a7d7b68360e7770f4f7727a0e7d2836"], 0x18}, 0x1, 0x0, 0x0, 0x40000}, 0x4000000) setsockopt$packet_int(0xffffffffffffffff, 0x107, 0x12, &(0x7f0000000040)=0x60f, 0x4) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000001c0)) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1) write$binfmt_misc(0xffffffffffffffff, &(0x7f0000000200)="3ce1873384bcebc3d3e83cca197379bccdba8203589d3911a6b79f20a926b3bfca04ab8f2b0a0985cca7d3fe4ae13540011fc45de017b64543376e68048612a124738dd4047154dfff61f5c4051df0aa535e320204fc680543c62b831523d60405fe5534d09197559a788b5546988fc00c3368a73a0aab27805b701c745f7038494cd753d8fbf26fd8b75eb164eb4a9070dd2e32f97dcf82ce5f86e4064c0089211613a6b27a6200f11acd6960423a1a010e25faa239e49956127edc7f63beb7506fa3d6885e10830504da4b3cd9d2df8672f74e16", 0xd5) landlock_create_ruleset(&(0x7f0000000180)={0x100}, 0x18, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000300)=@base={0x5, 0xc, 0x8, 0x40, 0xc0, 0x1}, 0x50) rseq(&(0x7f0000000180)={0x0, 0x0, 0x0, 0x4}, 0x20, 0x0, 0x0) unshare(0x600) r1 = socket$packet(0x11, 0x2, 0x300) listxattr(0x0, 0x0, 0x0) recvmsg(r1, &(0x7f00000002c0)={0x0, 0x0, 0x0}, 0x2) 10.72838876s ago: executing program 2 (id=2440): r0 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@base={0x12, 0x44, 0x4, 0x2, 0x0, 0x1}, 0x50) socketpair(0x1, 0x2, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f00000005c0)={r0, &(0x7f00000003c0), &(0x7f0000000580)=@tcp=r1, 0x700}, 0x20) bpf$BPF_PROG_ATTACH(0x8, &(0x7f0000002240)={@fallback, 0xffffffffffffffff, 0x19, 0x4}, 0x20) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x4) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) keyctl$KEYCTL_RESTRICT_KEYRING(0x1d, 0x0, 0x0, &(0x7f0000000040)=@chain) sendmsg$nl_generic(0xffffffffffffffff, 0x0, 0x20004014) getpid() prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r2 = syz_open_dev$MSR(&(0x7f0000000240), 0x0, 0x0) read$msr(r2, &(0x7f0000019680)=""/102392, 0x18ff8) syz_usb_connect(0x2, 0x4d, &(0x7f0000000b40)=ANY=[@ANYBLOB="12010002c3128e085104408182040102030109023b0002008030080904457f000202fff0052406000005240006000d240f010100000009"], &(0x7f0000000b00)={0x0, 0x0, 0x0, 0x0}) 7.208555841s ago: executing program 4 (id=2442): r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000000000040260933334000000000010902240001000000000904000001030100000921000000012201000905810308"], 0x0) syz_usb_disconnect(r0) r1 = syz_usb_connect$hid(0x3, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="120110010000004058040350"], 0x0) syz_usb_control_io$hid(r1, 0x0, 0x0) syz_usb_control_io$hid(r1, 0x0, 0x0) syz_usb_connect(0x3, 0x63, &(0x7f0000000880)={{0x12, 0x1, 0x0, 0xd0, 0xe3, 0x6b, 0x0, 0x5e3, 0x723, 0x9451, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x51, 0x1, 0x5, 0xc, 0x70, 0x7, "", [{{0x9, 0x4, 0x2f, 0xf6, 0x6, 0xb8, 0x8d, 0x26, 0x9, [], [{{0x9, 0x5, 0x9, 0x2, 0x400, 0x7f, 0x4, 0x9}}, {{0x9, 0x5, 0x80, 0x10, 0x0, 0x2, 0x80, 0x7}}, {{0x9, 0x5, 0x80, 0x10, 0x8, 0x6, 0xe2, 0x1}}, {{0x9, 0x5, 0x3, 0x14, 0x400, 0x1, 0x9, 0x7, [@uac_iso={0x7, 0x25, 0x1, 0x8}]}}, {{0x9, 0x5, 0x6, 0x10, 0x200, 0x0, 0x1, 0x10}}, {{0x9, 0x5, 0xf, 0x0, 0x10, 0x2, 0x7, 0x8c, [@generic={0x2, 0x6}]}}]}}]}}]}}, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_ep_write(r0, 0x81, 0xffffffffffffff6d, &(0x7f0000000100)="019a18370cfb661ba08c228ce6ca19b6a99a071ca34c72c891f8a260fa00000080977dae8d64a30e92cd51117c4a71e26518e804c00058e6c7c0c363027251668bb650d90000000000") fsopen(&(0x7f0000000100)='ceph\x00', 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000840)={0x1, 0xf, &(0x7f00000002c0)=@ringbuf={{0x18, 0x8, 0x0, 0x0, 0x14}, {{}, {}, {}, {0x85, 0x0, 0x0, 0x5}, {0x4, 0x1, 0xb, 0x9, 0xa}}, {{0x5, 0x0, 0x3}}, [], {{0x7, 0x1, 0x7, 0x8}, {0x6, 0x0, 0x5, 0x8, 0x0, 0x0, 0x2}, {0x85, 0x0, 0x0, 0x7}}}, &(0x7f0000000980)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x8, '\x00', 0x0, @fallback=0x12, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) 6.265238377s ago: executing program 2 (id=2443): prlimit64(0x0, 0xe, &(0x7f0000000000)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f0000000200)={'\x00', 0x118d, 0x5, 0x8, 0x3352, 0x1}) r0 = getpgrp(0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000100)=0x5) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) r1 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r1, 0x29, 0x40, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r2 = getpid() sched_setscheduler(r2, 0x2, &(0x7f0000000000)=0x3) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) r3 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) r4 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r4, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000016c0)=@newsa={0x138, 0x10, 0x1, 0xfff7fffe, 0x100, {{@in6=@initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, @in6=@private1={0xfc, 0x1, '\x00', 0x1}, 0x1, 0x714, 0x4e23, 0x5, 0x0, 0x0, 0x20, 0x3a}, {@in=@multicast2, 0x4d4, 0x6c}, @in=@loopback, {0x0, 0x192, 0x6, 0xffff, 0x8251c, 0x2, 0xfffffffffffffff8, 0xe2e237c}, {0xffffffffffffffff, 0x0, 0x1f, 0xfffffffffffffffe}, {0x2, 0xfffffffc, 0x40}, 0x70bd2a, 0x3504, 0x2, 0x1, 0x9, 0x20}, [@algo_comp={0x48, 0x3, {{'deflate\x00'}}}]}, 0x138}, 0x1, 0x0, 0x0, 0x8801}, 0x0) r5 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r5, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000480)=ANY=[@ANYBLOB="3c000000120001000000000000000000e0000002000004000000000000000000000004d50200040014000d"], 0x3c}}, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r3, 0x1, 0x0) r6 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r6, &(0x7f0000032680)=""/102392, 0x18ff8) mmap(&(0x7f0000000000/0xa000)=nil, 0xa000, 0x2000003, 0x4082172, 0xffffffffffffffff, 0x418a6000) 4.441233703s ago: executing program 2 (id=2444): r0 = socket$unix(0x1, 0x1, 0x0) bind$unix(r0, &(0x7f0000000080)=@file={0x1, './file0\x00'}, 0x6e) setsockopt$sock_int(r0, 0x1, 0x10, &(0x7f0000000040)=0x80000000, 0x4) clock_nanosleep(0xfffffff6, 0x0, &(0x7f0000000080)={0x0, 0x3938700}, 0xfffffffffffffffe) connect$unix(r0, &(0x7f0000000100)=@file={0x1, './file0\x00'}, 0x6e) 4.109981328s ago: executing program 3 (id=2446): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x42082, 0x0) pipe2(&(0x7f0000001cc0)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) fstat(r2, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0}) mount$9p_fd(0x0, &(0x7f0000000140)='.\x00', &(0x7f0000000040), 0x2204803, &(0x7f0000000240)={'trans=fd,', {'rfdno', 0x3d, r2}, 0x2c, {'wfdno', 0x3d, r3}, 0x2c, {[{@noxattr}], [{@smackfstransmute={'smackfstransmute', 0x3d, 'trans=fd,'}}, {@fscontext={'fscontext', 0x3d, 'sysadm_u'}}, {@subj_type={'subj_type', 0x3d, '!'}}, {@euid_eq={'euid', 0x3d, r4}}]}}) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) r5 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r5, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000580)={&(0x7f00000007c0)=@newqdisc={0x60, 0x24, 0x8, 0x1, 0x25dfdbfd, {0x0, 0x0, 0x0, r6, {0x0, 0x3}, {0xffff, 0xffff}, {0xfff2}}, [@qdisc_kind_options=@q_tbf={{0x8}, {0x34, 0x2, [@TCA_TBF_PARMS={0x28, 0x1, {{0x40, 0x1, 0x5, 0xd, 0xd9, 0x10}, {0x0, 0x2, 0x5, 0x3, 0x1}, 0x2, 0x5, 0x8d0}}, @TCA_TBF_BURST={0x8, 0x6, 0x10001}]}}]}, 0x60}, 0x1, 0x0, 0x0, 0x40088c1}, 0x0) r7 = syz_open_dev$usbfs(&(0x7f00000000c0), 0x205, 0x0) mmap(&(0x7f0000000000/0x400000)=nil, 0x400000, 0x1000002, 0x11012, r7, 0x0) sendmsg$nl_route_sched(r5, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000280)=@newqdisc={0x40, 0x24, 0x4ee4e6a52ff56541, 0x70b926, 0x25dfdc01, {0x0, 0x0, 0x0, r6, {0x0, 0xd}, {0x0, 0xb}, {0xffff, 0xfff2}}, [@qdisc_kind_options=@q_fq_codel={{0xd}, {0xc, 0x2, [@TCA_FQ_CODEL_TARGET={0x8, 0x1, 0xb}]}}]}, 0x40}, 0x1, 0x0, 0x0, 0x240048e4}, 0x4890) ioctl$SIOCSIFHWADDR(0xffffffffffffffff, 0x8914, 0x0) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) getsockopt$inet6_IPV6_FLOWLABEL_MGR(0xffffffffffffffff, 0x29, 0x20, &(0x7f0000000100)={@remote, 0x0, 0x2}, 0x0) r8 = syz_init_net_socket$bt_l2cap(0x1f, 0x3, 0x3) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)={0x0, 0x20}, 0x1, 0x0, 0x0, 0x240008c4}, 0x20008004) ioctl$FS_IOC_GETFSLABEL(r8, 0x400452c8, &(0x7f0000000100)) sendmsg$ETHTOOL_MSG_COALESCE_SET(0xffffffffffffffff, 0x0, 0x0) r9 = syz_init_net_socket$bt_l2cap(0x1f, 0x3, 0x3) ioctl$FS_IOC_GETFSLABEL(r9, 0x400452c8, 0x0) r10 = syz_init_net_socket$bt_l2cap(0x1f, 0x3, 0x3) ioctl$FS_IOC_GETFSLABEL(r10, 0x800452d2, &(0x7f0000000100)) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x3d, &(0x7f0000000040)={0x1, &(0x7f0000000080)=[{0x6, 0x9, 0x0, 0x7ffffdbd}]}) shmdt(0x0) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) r11 = fspick(0xffffffffffffffff, &(0x7f0000000000)='./file0\x00', 0x1) fsconfig$FSCONFIG_SET_STRING(r11, 0x1, &(0x7f00000000c0)='/^\x00', &(0x7f0000000100)='&\x00', 0x0) mremap(&(0x7f0000724000/0x4000)=nil, 0x4000, 0x4000, 0x0, &(0x7f0000290000/0x4000)=nil) 3.915078241s ago: executing program 4 (id=2447): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) madvise(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x17) r1 = userfaultfd(0x801) ioctl$UFFDIO_API(r1, 0xc018aa3f, &(0x7f00000000c0)={0xaa, 0x288}) ioctl$UFFDIO_REGISTER(r1, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000400000/0xc00000)=nil, 0xc00000}, 0x3}) ioctl$UFFDIO_WRITEPROTECT(r1, 0xc018aa06, &(0x7f0000000140)={{&(0x7f0000400000/0xc00000)=nil, 0xc00000}, 0x1}) 2.827208384s ago: executing program 4 (id=2450): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = fsopen(&(0x7f0000000340)='ramfs\x00', 0x1) fsconfig$FSCONFIG_CMD_CREATE(r1, 0x6, 0x0, 0x0, 0x0) r2 = fsmount(r1, 0x0, 0x86) fchdir(r2) r3 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./file1\x00', 0x42, 0x0) read$FUSE(r3, &(0x7f00000009c0)={0x2020}, 0x2020) sendmsg$nl_route(r0, &(0x7f00000006c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000140)=@newlink={0x44, 0x10, 0x40d, 0x70bd2a, 0x0, {0x0, 0x0, 0x0, 0x0, 0x20101}, [@IFLA_LINKINFO={0x24, 0x12, 0x0, 0x1, @bond={{0x9}, {0x14, 0x2, 0x0, 0x1, [@IFLA_BOND_MODE={0x5, 0x1, 0x6}, @IFLA_BOND_TLB_DYNAMIC_LB={0x5, 0x1b, 0x40}]}}}]}, 0x44}, 0x1, 0x0, 0x0, 0x90}, 0x0) 1.86146652s ago: executing program 3 (id=2454): syz_usb_connect(0x3, 0x36, &(0x7f00000000c0)=ANY=[@ANYBLOB="120100008010bd40820514009dbb0000000109022400011b00000009040000022a3e740009058bff7f0000100109050b362f"], 0x0) syz_open_dev$midi(&(0x7f0000000000), 0x3, 0x88c02) sendmsg$NFT_BATCH(0xffffffffffffffff, 0x0, 0x24040045) io_uring_setup(0x1195, &(0x7f0000000040)={0x0, 0x2150, 0xc000, 0x3, 0xce}) r0 = openat2(0xffffffffffffffff, &(0x7f0000000280)='./file0\x00', &(0x7f00000002c0)={0x581100, 0x15a}, 0x18) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000002040)={r0, 0x0, 0x1a5, 0x8d, &(0x7f0000000880)="ec589907d3bb53417809660f786a07a041a610950e83ec9018add8530b8e9c5e24221e6424c3857d936923fadd71dabcf50fb5d5016e468fb22fc9f7ce1d4febe814bd73478784854f449904d8da93b10decb1c11ba57d9f6b538e257ac5ce4d8add7fee18a19e3e506182329eace43fdd79a41c5414037760ce8d60d23027104f34089d3be4b9b0d1726529780913ab70b934bb18710841a003e1b848d4069d070075ab42597cd80854dd4e0466a598b30826ff8352107feb6fff4edff045e3b72726b496a8aff62289703e08371a8918a599fb2b1e7f43f892018222dee98c42030e3bfc062b2f65a7fad27328830b00fa0f3eee00061e99c28cce3da9ae08aa06b5ff8676cba33aa4300000ed3065c98cfb77fca3ef3303b2c1eea7d3b036cff1e83c0e510ede2db35ea978032fff28dcbaa17608c35ee468ea82ab22a6edc32fd639355f5e58e3ec8e178dccb3304a16ba514b01a3ecac0137faab91cc29d322cf82b494fbaf2bcbcccea867dda067403b5ce85f131e111130c05587fe8659e2b13d277dfac358b978cd347af1517a0ce1c4c66619b21d0b674ff01afb2f06bd4efd9a", &(0x7f0000000580)=""/141, 0x7, 0x0, 0xe8, 0x1000, &(0x7f0000000640)="52a980a7b9048fc18fcbb155a9b67cfd8a28677928d28f984f9e8fbebf32db2090f6670215bff9f5d54c12c7d5794c229f5d0daf5924d002b9fb9a040fdf7e8388beb2590fc0f7c93f83e410d63f286d572db7ae3c7c5799434b6328db3e7166e243deeffc4023c2c5528faf2637efed0c594218fbf18e71f0acfae83d833c821b7fe98dd090b9fb495a21c879fa423a252479a068d5fd2d55d9f8152536648de49ef9a65e30b0e0c130d9851b428899e425e8451204404d3e4fb0047e82ba2311416207745a1bfd140295e0eeb6c6fdc466239d0a434f1a232e693a8e86281beaa67a9440cb53ec", &(0x7f0000001040)="49288ce6a9270cbb23a89167351eab9f539530cd0a28161e0c4210ad6c0c9d7e013ad7e570af9b89b288d49a061c523e150440e418a991a7b55728287632bfbfd098d7c4b80a9442db976fdcc7874adbbf2aa685c77dd7c586c0afd588368a5e3af409ef48ff412fdebb81c1e9869762378e5dc44237a02d47603c418bc1191e849485a729c2268e9bd47847c0124b43226e9125e06ff6414c08050172befee1161c8faa2bb73f6c8e991f096f70136834b0dea1cc362d66cfd26c6e68ab3b2ef31be2a53a3aa10714dc9f226826460501ffb005d9e18ff8675f23d26337b77f1a39e9ef136d229ecda985046a06f8dc490b84b43cbb54d05733fc4996922c959ab3f88e5b80d7c11b317400e30559f55b54b62944ce4a2a20476c17e4c988cf9931070be2c79c5ea691c760f106f9755895ece4d22271b72f2f283fee9441cc03e452cbc29797aa485495798af9655e6bb5d7f61d9683300cdaba0dd86ca39eefc3a2065455dda9f5ae35de63267b11374267f241f180e9e8e24a4250b437ec0cee0b5b4e6b9f1a5519efd4912951d7ddb66fa638202a29a35bcd6e1c0d2512199cbab3c43d7ca59a70d807bb6d5803f1f69a1233ea69987b4e90e949f355243f74d84cf9f9eddba24b2a05b1b30f640a328d48887d18910455ff62e8bbb5f52c38ef9e123224a8f458ee95c30f31a0bd9d756c0a9356af6e5d62814dc528c155434ebfda6035f4382c302a9e6f8b41bad0178673fa7a7d1f4ce254c214dfdf109ddd500d6ab78f3d2487ba55337a8c4d1cec2b1d232aa4d201acc574f39bda630f5be9a938450ec1737f42631cfe7c5b8a0c6eb668122cea13a78225a601ae86f79b811d2a51a7d89d41ef2c840bf7342091ac2f6a74eaec065ca2ea00a47d4c0f28d8a2dd7b3272bc7d505fa3f24df14dd32305df1254727e41660650e8226fb47b28b0cd6305c0123895f567e8e53cc02182319c0203664946603e45cb93f8fae5e21274194853fc10796fe0558cb29c381a849a27353cdf8db5c7cbd293f88fdab70bae0bb4657c9cc07433ffd864bd5ed00d087370b0f95a6153c1f147bc4d48a12349ffe5488e67d1f2612e5c7134e51af608c704c7a49b99d5da9d7f5d9d7651c015028f5abe6e4b7b0819e1dfc1a3b6329d631eef61f7ebf10db394c6370cff983fc2f74d580517cc6dd0e4e6e8c398a5fd089c42bebd15d590b2982f541868ee8d292e5e5e148b887f9b5d033c21e04f675472ee44b425b8b453a5293c2b7374ccc91a7cb3664da8e476fd1238f4fbfa1394ab629bfc6be5a170f531431895bb9c895aa908f7cc606cae53d747aa98be34fd6fdf7a2011019906d8a8dec776d80e45f8b19b27a987ba5703d660ed27d4935e022a9e3f612da6cd627bbef8868523b47d4e2bb31edf19a2af4a683512d735d7ae0f33ebb9cd9a4619741f70230d8aae0de1880116cfacc4e33e56607b8b8de27b33d977b0c547856dd04a81de14e4e46950f2aa4d4ce53fa7b1ebe5fecfd8a606e45a20570630fe451acf5fb5e856455777ddf6bafb22ad71323ba41693efef3054afd952dcf42e262834a79ef8daf241c972e85c8460d26c6947da8c63690a487a40b3d6a0685facfae08c2e4a07f7919676fe0a583340a1c2156849979e709b1b2879db4143bed90c6e229d333f22561ee1dd5f88e31dcb7f3eb1cffdcec9746e518a1d72621a354b73c9c8c210dbd50d216a4c950d903bf8398bf6e14cf931fe0d3d12aa2c37a312ff388f0550c5d0bfa8ef9e051ff4beaf4ee2fd66987826fb9092ba6ec73b1264c690e6df3a3b98c148c8e020b67f83d996a2a1bf0f8d145727e93f5b9a3fbdde243972f0a5d536774452e6911bd4380a086405793b192049dda871181f7837378ba3f1acdb8d0c83811a958b06096303789f6dbe5cc6f551d13f497ced6a69be7bddc85f93d438bebc81cbb40b51a05a0d4f9da6c0dfbae5640bbe3622df3009df989aa165f86507e98b2edfb9493e6d9d97beccad25e6f28e62ef170bc706d8ce1501885995bef4204046491127a4c1d006c89a3cdc6414dbf6b3ef3a7c4d1f98a7a05c27fc27d382dd139d0ebf1d716d5319301782ca1ac2462300e8b2b97724acffc3aa6675e5655be5f620294adc06fa32a29afb286bbb14d53f75152602c8e39d9af0f3212ef35cf2261d1b13590f5f4f1adcaa1b12e259ca7a268e2762a00c7ab005083fb07fd171f9b39e161dcb4b0d054ea700d4b6a6808d5e7d4ff6028fea282db8684cfcfb878bbacfc3a06d9e7a26848a9d406e3be82fd11f7e82739cacf76c6aa77e52e70ef540d0a8c01ef66855420e0811356c4613397822eadbec63828a2a2fac90b258a375ca901befdd6773486bddbf2841915fdeff640dcc537f1511059cc4e9485e12c57cf9427de4a8f07789ea6ece731d3b77374fd9696effa28d7da5d7fc377b13c1a7e594fa240a0a6770776786597d7bfcbab9fefe9c9e2027a9194119cc9f56418975cfe06d439d3446829e5f419c29b5fa36b9fea42d72c5f01909491a9cb85c419464b497e16b64656172b911cf554152678622d7225ff6b2b73c7d2eeed70a628661ee97edc7aa36064dee917c9d3156b115555a515ecb1f66a8c454aba0811d2c9dd800f682a054b4f8deb76a4ec6cc338931537db5621c4be5084f5b9eae55f81424155bbc8481c1cf689243a935fdaeccf991e70e2b78854c641cfd61e771832b4fe0659f9baa730c5502ca771cad011cbee08a430054ee5ed9bdcc98684102dcac3a11dcdb07566e0332c44b7d2e3b741f45443bc4b047a6ef9927288c18925d280714bf8147630ae2bb6e9ef2f1b0c52c94c66f02cc7761f2b53936c53a275795bd684b450d9ba7a408e4ab1d476243e4e1f59d33f23aa3dea58aae505abc06c0c63f6a4e2904f500fc0ad735aa612c0c54f309688b38e44fcdaedd145ec4d4da3b0739e2c1cc7a82a02fd78ac4d9aa0eed5a982d1f1c6ca8d4889dc77c33b80f87fdeb59f38b21bd999420b5a71ff481769be675c183a855d1de886ad92643e8816e59607d2f2e3ed3c9822dd6b899219fc660c4c33140a1da8bf7474b1b7a18079736b52c4d3cf2e4a95cdf366786ba3909935703f77008dc8d8546e04e6fba39070ecd9d945d99c2ed9eb8e7c3767959317d468385a9561128051c26ee5a6b889a8649ccc17d1336ad61a0ae026e498b899feab1f3f4bc3b5ee468830da0a394070edbdf8ba0a2841517362948f4aa15d27951e2d184f0021ba928178ae0288cd26d261d610817fbe002e6a0332575c069cce8f400012d7b10cc7f1b3e5b51175e5b79dff3bf3dcc48ab98cd5cc370785c2fe2fb03e54621f67061ff93b918528a8edeb0be7bad45fd3d97fd35325c3df9c3dc73fdd53c5a52f162490cd38b63e1ff4bd7333db924261fdad160491a0ae0640c17baac5c2dabd4e4b337a6300f667097cb111fd21d77bd4ef86070d56a6562561cd512919d842a790bd44086b1bca9e70cfbd627722b54527a6980c238ef692b19829dacf5619cf3b1fbe88cd416b5ff0753ee3c99ba5d03cbf3e8eb5396c6ffcf192699119894d224da514eaf2a25495dbe48f687b37b916aa0cc802dd70763ca3e655e6e1d7e583906f52ebbf1ae80a850d5b7b44e98d8638ca9256dc8971e6ec350a23e246d1a79fd5b2d8a80eb134bffe3bc9b1903bd2fe06bef17866127f140e67577030de5c025f281d8c4a13c7ea3a7ee2bcc14b8c443779b0eefbd8118539d2037f44d975304f6f99ba748ece168fdd24631879bc37619287f6c4a8a84bb820a68023b7e9fa53a852244c326d8913c4c8c053698be5e46938aa7948fb337b9f35aba3f3981b070f8d356bf56e23e92ac25be39d2990056b62197326a6bb451a805fa952d78bd520130924fe75a47c17175788e72ac4a1d875235db793048f5c8c79101a91e450bef83894cf24d0b0c0a426d77cb3aaa948b5842822841cdc625830cfa5be0d95b06883ba4a5f827d8284b0cd5651caf7f4f603937320651a6e6dfba6abfc7bdf831c0f41264dfebd7874fa0c51c1ce746e7b7296a9c0740bc1f1b7f8287cbd083fff7266241b391e36b8a8e39362eb5cf07535215830e0393a909d4f42c42a46c046d7c15dbe2216a990139dbedcb7979b66268903cede39679e213b0a3d91ec83087dbe5297e43f94f53139a09db6315b3e15226bf29bdd85e43fd66352c7876981e1985444e2ee4fff098523d6fb30daef196323253b77becfe172083df6d8cb99820e3099ea86e75ce25d5668ec1d85de2959e67a106a4ee1c495d41aa527a2deec2cca68a4f1b124085dffa098e1b7654e5df68c85f9daa8f6de683a07a304547012a8f2417f53950d75e74c5609c93f5f267be2795d3cd89e8008661043c536516383f85f58d40a03dbd35b2afa94bc886f3e27d0585e820e472e9f66d36f611dc73c75a503643d29611ec279750b1d7fe892c8019ef518809e7723d23e48bf801d2bdd4e3ba48f8a2ad58b8ecc9d9cd049a839f33c4a9bd6e5354ea26a603364d7cdc3bd1a03193e6d0e083450ee0b7e903d66a64b8705260f95b2ecde4ee77828ea462d0ac032b58b52b79a4148487dc9b9e98eb4f1cf43e30a54165ada8563a83139b518ac11e86b2e4faf8950b25e2ab67c521b3d7770aa3750cc846fba1a5bb76f9de5330f452e21ba0f0e605d482527fde444276cd80be60aa7a87eecc143cc1a65a0bc268c8407f83f63152dd7a6c954475bffb34e605d7321761cd2644dac105e9074945175aacd07e8c8e89409068877abe55d1a2e6dc7bbe9e2cd5147941ed8910c75597afac938bf98e389404b4952076ba4fccf2f1c6839dd9ed7ca3815358413b5e5e6e0322bc7244c42f34d90f7ac99a0262617416b11d89cddf687a6f76ba1349828a703c310e5d2ca0ea841cf7f0bbb0156d9cb007440506192ab6684dcf43fe8b972710fdd438408c069da8f67ab5d82084f8cfe5a981009db87dbf03845055cf2bfc1ebb1c0f11e67670f731ca6dd5cf298c03c2291de70b0c29abbe7006ea12137ed9227c284dc764e534d13d972e5a880e941689051e5ac6a0aec244330f1fbd2e14b7297884fe468f7922460ad9894c20ec10b0c973c1830b3eb2eb8e200a4d93980b744462c4ab7cc8a9d82492a35905ff4bab7a5055e71bb8a28dfedbb09cf06b9634f312b57c41a08b349f353c1b4f27c4d14090632328cb8a5ac791ae41b752621793cc543acb172725ca235ee4cf085e10d75afd6eb9cf9dba6ad8c0981323c0fce510c1c1e680f45fdaf8bc6b80dd72271f3a9f6844d4523bc352c202943401b81c048f46aad0579e584ce5fed44af488cc3a1349da81633e725885793de499bf76869a2157b183ac41bfa9241623c5be525d8dc2b24297625d53a5afadd111a2e006eae2768e642ec266e46d414bbd10f3abdc6cc7b6e0d569efe38502b3a89b11e1b9f85f8bfedf38713fc5fe94c1607fb20712e2e103e465918c6e4618821cd5ac1e29482cf1896398c380595cdf0615e91e3ba45a1cdacc7674bef9f6e55080fca3d5c560fb195b7f9911476bf28400074f76239cac4d9c6876bc9f465816aebafcf8679e8a858fad978574cfb42f3dd7a6153fb41e706be27e0bb54e94ed9918eb66f6348df28c0cbe9d14d2c1ecd1f98a02af7090bcb472a768ff0bd70160b43e53fd654b0c8b9045b4c818d2dba698a7119a021192fdb6bae92090bd394dfc6eed58554bfd41d5baf98fee02238c56ef1490ce6b97f6c44919604831", 0x5, 0x0, 0x6}, 0x50) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$SOUND_PCM_READ_RATE(r0, 0x80045002, &(0x7f0000000380)) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r1, 0x4018620d, &(0x7f0000000100)) r2 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000140)='./binderfs/binder0\x00', 0x0, 0x0) memfd_create(&(0x7f0000000440)='./binderfs/binder0\x00', 0x0) pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_GET(r5, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f00000000c0)={0x94, 0x0, 0x1, 0x505, 0x0, 0x0, {0xa, 0x0, 0xffff}, [@CTA_TUPLE_ORIG={0x3c, 0x2, 0x0, 0x1, [@CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @mcast1}, {0x14, 0x4, @mcast2}}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x84}}]}, @CTA_TUPLE_ORIG={0x3c, 0x1, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5}}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @mcast1}, {0x14, 0x4, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01'}}}]}, @CTA_TIMEOUT={0x8, 0x7, 0x1, 0x0, 0x1}]}, 0x94}, 0x1, 0x0, 0x0, 0x4041}, 0x0) r6 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_GET(r6, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000003c0)={0x54, 0x0, 0x1, 0x505, 0x0, 0x0, {0xa, 0x0, 0x5}, [@CTA_TUPLE_ORIG={0x3c, 0x2, 0x0, 0x1, [@CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @mcast1}, {0x14, 0x4, @mcast2}}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5}}]}, @CTA_NAT_SRC={0x4}]}, 0x54}}, 0x0) ioctl$sock_SIOCSIFVLAN_ADD_VLAN_CMD(r4, 0x8983, &(0x7f0000000240)={0x0, 'veth0_virt_wifi\x00', {}, 0x7}) openat$vcs(0xffffffffffffff9c, &(0x7f0000000300), 0x200800, 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000003c0)={0x4c, 0x0, &(0x7f0000000b00)=[@reply_sg={0x40486312, {0x3, 0x0, 0x0, 0x0, 0x20, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000a40)={@flat=@weak_binder={0x77622a85, 0x100, 0x3}, @flat=@handle={0x73682a85, 0x0, 0x1}, @flat=@weak_binder={0x77622a85, 0x0, 0x3}}, &(0x7f0000000340)}, 0x400}], 0x0, 0x0, 0x0}) r7 = socket(0x40000000015, 0x5, 0x0) connect$inet(r7, &(0x7f0000000040)={0x2, 0x4e20, @loopback}, 0x10) bind$inet(r7, &(0x7f0000000340)={0x2, 0x4e20, @loopback}, 0x57) sendmsg$xdp(r7, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f00000000c0)="e9", 0x1}], 0x1, 0x0, 0x0, 0x10}, 0x0) recvmmsg(r7, &(0x7f0000001ac0)=[{{0x0, 0x0, &(0x7f0000001680)=[{&(0x7f00000012c0)=""/93, 0x5d}], 0x1}, 0x1}], 0x1, 0x0, 0x0) r8 = dup3(r2, r1, 0x0) r9 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r9, 0x4018620d, &(0x7f0000004a80)={0x73622a85, 0x100, 0x1}) ioctl$BINDER_WRITE_READ(r8, 0xc0306201, &(0x7f00000004c0)={0x8, 0x0, &(0x7f0000000000)=[@acquire], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r8, 0xc0306201, &(0x7f00000001c0)={0x4c, 0x0, &(0x7f0000000fc0)=[@transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x58, 0x18, &(0x7f0000000500)={@flat=@weak_binder={0x77622a85, 0x100a, 0x8000000000}, @fda={0x66646185, 0x3, 0x0, 0x25}, @fda={0x66646185, 0x5, 0x2, 0x24}}, &(0x7f0000000200)={0x0, 0x18, 0x38}}}], 0x0, 0x0, 0x0}) ioctl$SNAPSHOT_PREF_IMAGE_SIZE(0xffffffffffffffff, 0x3312, 0x3) 1.750420281s ago: executing program 1 (id=2455): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) mknodat(0xffffffffffffff9c, &(0x7f0000000140)='./file0\x00', 0x1000, 0xfffffff7) r1 = epoll_create1(0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./file0\x00', 0x40042, 0x1) mount$9p_fd(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000100), 0x2000001, &(0x7f00000001c0)={'trans=fd,', {'rfdno', 0x3d, r2}, 0x2c, {'wfdno', 0x3d, r1}}) r3 = syz_usb_connect(0x0, 0x24, &(0x7f0000000700)=ANY=[@ANYBLOB="1201000059d360205f0501d09288000000010902120001030000000904"], 0x0) syz_usb_control_io$uac1(r3, 0x0, 0x0) syz_usb_control_io$hid(r3, 0x0, &(0x7f0000000040)={0x18, &(0x7f0000000080)=ANY=[], 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$uac1(r3, 0x0, 0x0) r4 = socket$kcm(0x2d, 0x2, 0x0) r5 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000040)={0x1f, 0x2, &(0x7f0000001c40)=ANY=[@ANYBLOB="85000000a800000095"], &(0x7f0000000600)='syzkaller\x00', 0x0, 0x0, 0x0, 0x40f00, 0x13}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000500)={r5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x48) r6 = bpf$PROG_LOAD(0x5, &(0x7f0000000680)={0x5, 0xb, &(0x7f0000000180)=ANY=[@ANYBLOB="18080000000000000000000000000000180100002020702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000000700000095"], &(0x7f00000000c0)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2c, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) sendmsg$kcm(r4, &(0x7f0000000940)={0x0, 0x0, &(0x7f0000000180)=[{&(0x7f0000000100)="d8001c000831cf64e59a180081064e81f782db44fd56170d", 0x18}], 0x1}, 0x8040) ioctl$sock_kcm_SIOCKCMATTACH(r4, 0x89e3, &(0x7f0000000180)={r4, r6}) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) syz_usb_connect(0x0, 0x24, &(0x7f0000000100)=ANY=[@ANYBLOB="12010100ab51a0407b0500000000000000010902120001200000000904", @ANYRES32], 0x0) r7 = socket$nl_route(0x10, 0x3, 0x0) r8 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r8, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r7, &(0x7f00000004c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000003c0)=@newqdisc={0x78, 0x24, 0x4ee4e6a52ff56541, 0x70bd26, 0xffffffff, {0x0, 0x0, 0x0, r9, {0x0, 0xfff1}, {0xffff, 0xffff}, {0x0, 0xc}}, [@qdisc_kind_options=@q_sfq={{0x8}, {0x4c, 0x2, {{0x5, 0x2, 0x9, 0x0, 0xaba}, 0x4, 0x0, 0x3ff, 0x1, 0x9, 0x19, 0x6, 0x1f, 0x5, 0x9, {0x8, 0x400, 0x80, 0x8274, 0x3, 0x15}}}}]}, 0x78}}, 0x20040084) 1.575298992s ago: executing program 1 (id=2456): r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000000000040260933334000000000010902240001000000000904000001030100000921000000012201000905810308"], 0x0) syz_usb_disconnect(r0) r1 = syz_usb_connect$hid(0x3, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="120110010000004058040350"], 0x0) syz_usb_control_io$hid(r1, 0x0, 0x0) syz_usb_control_io$hid(r1, 0x0, 0x0) syz_usb_connect(0x3, 0x63, &(0x7f0000000880)={{0x12, 0x1, 0x0, 0xd0, 0xe3, 0x6b, 0x0, 0x5e3, 0x723, 0x9451, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x51, 0x1, 0x5, 0xc, 0x70, 0x7, "", [{{0x9, 0x4, 0x2f, 0xf6, 0x6, 0xb8, 0x8d, 0x26, 0x9, [], [{{0x9, 0x5, 0x9, 0x2, 0x400, 0x7f, 0x4, 0x9}}, {{0x9, 0x5, 0x80, 0x10, 0x0, 0x2, 0x80, 0x7}}, {{0x9, 0x5, 0x80, 0x10, 0x8, 0x6, 0xe2, 0x1}}, {{0x9, 0x5, 0x3, 0x14, 0x400, 0x1, 0x9, 0x7, [@uac_iso={0x7, 0x25, 0x1, 0x8}]}}, {{0x9, 0x5, 0x6, 0x10, 0x200, 0x0, 0x1, 0x10}}, {{0x9, 0x5, 0xf, 0x0, 0x10, 0x2, 0x7, 0x8c, [@generic={0x2, 0x6}]}}]}}]}}]}}, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_ep_write(r0, 0x81, 0xffffffffffffff6d, &(0x7f0000000100)="019a18370cfb661ba08c228ce6ca19b6a99a071ca34c72c891f8a260fa00000080977dae8d64a30e92cd51117c4a71e26518e804c00058e6c7c0c363027251668bb650d90000000000") fsopen(&(0x7f0000000100)='ceph\x00', 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000840)={0x1, 0xf, &(0x7f00000002c0)=@ringbuf={{0x18, 0x8, 0x0, 0x0, 0x14}, {{}, {}, {}, {0x85, 0x0, 0x0, 0x5}, {0x4, 0x1, 0xb, 0x9, 0xa}}, {{0x5, 0x0, 0x3}}, [], {{0x7, 0x1, 0x7, 0x8}, {0x6, 0x0, 0x5, 0x8, 0x0, 0x0, 0x2}, {0x85, 0x0, 0x0, 0x7}}}, &(0x7f0000000980)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x8, '\x00', 0x0, @fallback=0x12, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) 1.338167909s ago: executing program 2 (id=2457): unshare(0x40400) bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x19, 0x4, 0x4, 0x2, 0x0, 0x1}, 0x50) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000080)=@bpf_lsm={0x3, 0x4, 0x0, 0x0, 0x9, 0x0, 0x0, 0x41000, 0x2}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x10, 0x14, &(0x7f0000000400)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b7040000000000008500"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_LOAD_XDP(0x5, &(0x7f00000003c0)={0x6, 0x5, &(0x7f0000000100)=ANY=[@ANYBLOB="180000000000000000000000000000001850000000000020000000000000000095"], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0xfffffff0, 0x0, 0x0, 0x0, &(0x7f0000000080)}, 0x9a) open(&(0x7f00000005c0)='./bus\x00', 0x64842, 0x0) 1.124886263s ago: executing program 1 (id=2458): r0 = socket$inet(0x2, 0x1, 0x100) setsockopt$sock_int(r0, 0x1, 0x2, &(0x7f0000000040)=0x7f, 0x4) bind$inet(r0, &(0x7f0000e15000)={0x2, 0x4e20, @multicast2}, 0x10) r1 = socket$inet(0x2, 0x1, 0x0) setsockopt$sock_int(r1, 0x1, 0x2, &(0x7f0000000040)=0x7f, 0x4) bind$inet(r1, &(0x7f0000e15000)={0x2, 0x4e20, @multicast2}, 0x10) listen(r1, 0x6) 1.083235011s ago: executing program 4 (id=2459): syz_open_dev$evdev(&(0x7f00000000c0), 0xfffffffffffffffc, 0x822b01) r0 = syz_open_procfs(0x0, &(0x7f00000001c0)='fd/3\x00') r1 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000000040)) epoll_ctl$EPOLL_CTL_MOD(r1, 0x3, r0, &(0x7f0000000c40)={0x8000203d}) 974.072523ms ago: executing program 2 (id=2460): socket$netlink(0x10, 0x3, 0x8000000004) r0 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e23, @empty}, 0x3) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = socket$nl_route(0x10, 0x3, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000500)={0x1, 0x1, &(0x7f0000000140)=ANY=[@ANYBLOB], &(0x7f00000000c0)='GPL\x00', 0x9, 0x0, 0x0, 0x41000, 0x40}, 0x94) r3 = syz_init_net_socket$bt_rfcomm(0x1f, 0x1, 0x3) setsockopt$bt_BT_SECURITY(r3, 0x112, 0x4, 0x0, 0x0) ioctl$BTRFS_IOC_GET_FEATURES(0xffffffffffffffff, 0x80189439, &(0x7f0000000000)) setsockopt$SO_ATTACH_FILTER(0xffffffffffffffff, 0x1, 0x1a, &(0x7f0000000040)={0x2, &(0x7f0000000000)=[{0x6, 0x2, 0x4, 0x5e}, {0x35, 0x0, 0x2, 0x20}]}, 0x10) rt_sigprocmask(0x7, &(0x7f0000000100)={[0x8]}, 0x0, 0x8) ioctl$int_in(0xffffffffffffffff, 0x5452, &(0x7f0000000000)=0x5) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000140)={0xe, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="183f0000000000000000200000000000711007000000000094fffa0700000000"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0xc}, 0x80) setsockopt$SO_ATTACH_FILTER(0xffffffffffffffff, 0x1, 0x1a, &(0x7f0000000040)={0x3d, &(0x7f0000000080)=[{0x25, 0x2, 0x2, 0xffffffff}, {0x6, 0x2, 0x9, 0xfffffff7}, {0x4, 0x9, 0xff, 0x3}, {0x6, 0x1, 0x4, 0x4}]}, 0x10) capset(&(0x7f0000000500)={0x20080522}, &(0x7f0000000200)={0x200002, 0x200003, 0x801, 0x4, 0x7}) r4 = socket$netlink(0x10, 0x3, 0x8000000004) writev(r4, &(0x7f0000000140)=[{&(0x7f0000000900)="580000001400192340834b80040d8c560a066e0202ff000000000000000058000b4824ca945f64009400ff0325010ebc000000000000008000f0fffeffe809005300fff5dd00000010000200060c10000000010000000000", 0x58}], 0x1) r5 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000340), 0x0, 0x0) r6 = ioctl$KVM_CREATE_VM(r5, 0xae01, 0x0) ioctl$KVM_SET_BOOT_CPU_ID(r6, 0xae78, &(0x7f0000000000)=0x1) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0xa, &(0x7f0000000200)={0x2000000000000014}) sendmsg$nl_route(r2, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000a00)=ANY=[@ANYBLOB="18002000150074499fed6eb0ca789ef200fcdbdf", @ANYRES32=0x0], 0x18}, 0x1, 0x0, 0x0, 0x80}, 0x4000000) bind$inet6(r1, &(0x7f0000000080)={0xa, 0x6e22, 0x9, @empty, 0x8}, 0x1c) 692.570123ms ago: executing program 1 (id=2461): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) r1 = socket$igmp(0x2, 0x3, 0x2) setsockopt$ARPT_SO_SET_REPLACE(r1, 0x0, 0x60, &(0x7f0000000440)={'filter\x00', 0xb001, 0x4, 0x3f0, 0x0, 0xe8, 0x0, 0x308, 0x308, 0x308, 0x7fffffe, 0x0, {[{{@arp={@multicast1, @broadcast, 0xff000000, 0xff, 0x9, 0x12, {@empty, {[0x0, 0x0, 0x0, 0xff, 0xff]}}, {@empty, {[0xff, 0xff, 0x0, 0xff, 0xff]}}, 0x0, 0x3, 0x3, 0xa90a, 0x6, 0x3ff, 'veth0_vlan\x00', 'wg2\x00', {0xff}, {0xff}, 0x0, 0x71}, 0xc0, 0xe8}, @unspec=@STANDARD={0x28, '\x00', 0x0, 0x1f8}}, {{@arp={@empty, @loopback, 0x0, 0xffffffff, 0xe, 0x2, {@mac=@local, {[0xff, 0xff, 0x0, 0xff, 0xff]}}, {@mac=@random="8e932bc3db22", {[0x0, 0xff, 0x0, 0xff]}}, 0x0, 0x0, 0x400, 0x4fd9, 0x0, 0x98dc, 'team_slave_1\x00', 'macsec0\x00', {0xff}, {0xff}, 0x0, 0x280}, 0xc0, 0x110, 0x0, {0x0, 0x1e03}}, @mangle={0x50, 'mangle\x00', 0x0, {@empty, @empty, @multicast2, @loopback, 0xf, 0x1}}}, {{@uncond, 0xc0, 0x110}, @mangle={0x50, 'mangle\x00', 0x0, {@empty, @mac=@dev={'\xaa\xaa\xaa\xaa\xaa', 0x35}, @loopback, @multicast1, 0xf}}}], {{'\x00', 0xc0, 0xe8}, {0x28}}}}, 0x440) ioctl$TIOCMBIS(0xffffffffffffffff, 0x5416, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000040)={0x60, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, 0x0) semctl$SEM_STAT(0x0, 0x4, 0x12, &(0x7f0000000500)=""/125) r2 = getpid() sched_setscheduler(r2, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r4, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x0) socket$inet_udp(0x2, 0x2, 0x11) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)=[{0x0}, {&(0x7f0000000580)="d4fa0c511aad03aa5ed217677bc41c027d9c830c439c7f821ddd78b6915cb170e7603acf9e433c2903bb6773f4b0130668a1e5b5e08d21d0b69c28ca3455aed65855c86f3d1e5789d26375a0d85eaf5e92e19c9affcf76e7a94e76556d2b104ebf645747fadc91460f4b3c94e1a89b51be4a6aa4c65285f988329a8163b69c51b801500a5bacd0463976e2960e2679ef2feee5e6ce6bb78a51fb0e15820d13e4a5aa9e0742a6f8d677ad28fea356657bb550c8311b682d9003c82267a15aa7334bc53b65b9119a1a7d905c7dd365b85c230bbad0d5d0a79819e112637819d9a187cfdf782c6127d2d4281926ab0e22f7346b616fe28ed0b9f4a0c9fdac6d3a90a9c38b5e31448a455463", 0x10a}], 0x2}, 0x0) sendmsg$IPSET_CMD_CREATE(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f00000044c0)={&(0x7f0000000400)=ANY=[@ANYBLOB="5c00000002060108000000000000000000000000050005000a000000050001000700000005000400000000000900020073797a310000000015000300686173683a69702c706f72742c6e6574"], 0x5c}}, 0x20084884) sendmsg$IPSET_CMD_ADD(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000480)=ANY=[@ANYBLOB="74000000090601020000000000000000030000000900020073797a310000000005000100070000004c0007801800018014000240fe8000000000000000000000000000aa1800148014000240fc000000000000000000000000000000060004404e1f0000050007008400000006000540"], 0x74}, 0x1, 0x300, 0x0, 0x10040003}, 0x0) 437.395ms ago: executing program 4 (id=2462): r0 = bpf$PROG_LOAD(0x5, &(0x7f0000001700)={0x6, 0xb, &(0x7f00000002c0)=ANY=[@ANYBLOB="18000000000000000000000000000000180100002020782500000000002020207b1af8ff00000000bf"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x21, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="19000000040000000800000002"], 0x48) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000140)={{r1}, &(0x7f0000000080), &(0x7f0000000100)=r0}, 0x20) bpf$MAP_GET_NEXT_KEY(0x2, &(0x7f0000000200)={r1, &(0x7f0000000080), &(0x7f0000000000)=""/10, 0x2}, 0x20) 306.102066ms ago: executing program 1 (id=2463): landlock_restrict_self(0xffffffffffffffff, 0xd) r0 = syz_open_dev$evdev(&(0x7f0000000080), 0x2, 0x842) ioctl$EVIOCGBITSND(r0, 0x40044591, 0x0) writev(r0, &(0x7f0000000c00)=[{&(0x7f0000000200)="66cee50b47ccc32ff304b3a399e76bfae78f5abc66a01dc01b", 0x19}], 0x1) socket$inet_udp(0x2, 0x2, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x1f7) mount(0x0, &(0x7f0000000040)='./dev\x00', &(0x7f0000001600)='proc\x00', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000001700)='./dev/kmsg\x00', 0x1, 0x0) pselect6(0x40, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x800}, 0x0, &(0x7f0000000240)={0x1f, 0x0, 0x8000000000000000}, &(0x7f0000000280)={0x0, 0x3938700}, 0x0) socket$unix(0x1, 0x2, 0x0) r1 = syz_usb_connect(0x0, 0x24, &(0x7f0000000040)=ANY=[@ANYBLOB="1201000003173610ef171e7206de010203010902f3c8010000000009040000000206"], 0x0) syz_usb_control_io$rtl8150(r1, 0x0, &(0x7f00000005c0)={0x2c, &(0x7f0000000080)=ANY=[@ANYBLOB="4030040000002e101dce"], 0x0, 0x0, 0x0, 0x0}) syz_genetlink_get_family_id$l2tp(&(0x7f0000000100), 0xffffffffffffffff) 79.926509ms ago: executing program 4 (id=2464): r0 = socket$inet_mptcp(0x2, 0x1, 0x106) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x7, &(0x7f0000000240)={0x1, &(0x7f0000000000)=[{0x6, 0x85, 0x7, 0x7ffc0001}]}) r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f0000000380)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-camellia-aesni\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f00000004c0)="2c385a7af3", 0x5) r2 = accept4(r1, 0x0, 0x0, 0x800) sendmmsg$alg(r2, &(0x7f0000000040)=[{0x0, 0x0, 0x0}], 0x1, 0x40800) recvmsg(r2, &(0x7f00000005c0)={0x0, 0x0, 0x0}, 0x0) bind$inet(r0, &(0x7f0000000040)={0x2, 0x4e24, @multicast2}, 0x10) sendmmsg$inet(r0, &(0x7f0000000100)=[{{&(0x7f0000000000)={0x2, 0x4e24, @local}, 0x10, &(0x7f0000000080)=[{&(0x7f0000000680)="fa61", 0x2}], 0x1}}], 0x1, 0x20040804) signalfd4(0xffffffffffffffff, &(0x7f00000008c0), 0x8, 0x800) 0s ago: executing program 1 (id=2465): close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) r0 = openat(0xffffffffffffff9c, &(0x7f0000000040)='.\x00', 0x660cc1, 0x0) flistxattr(r0, 0x0, 0x0) kernel console output (not intermixed with test programs): strings: Mfr=0, Product=0, SerialNumber=0 [ 570.172202][T11725] netlink: 60 bytes leftover after parsing attributes in process `syz.3.2110'. [ 570.227147][ T821] usb 2-1: config 0 descriptor?? [ 570.728666][ T4912] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 570.811288][ T4912] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 570.815707][ T4912] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 570.822480][ T4912] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 570.844229][ T4912] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 570.924305][T11701] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 570.924928][T11701] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 571.341313][ T821] aiptek 2-1:0.0: Aiptek using 400 ms programming speed [ 571.361645][ T821] input: Aiptek as /devices/platform/dummy_hcd.1/usb2/2-1/2-1:0.0/input/input26 [ 572.395903][ T9] usb 2-1: USB disconnect, device number 53 [ 572.396040][ C1] aiptek 2-1:0.0: aiptek_irq - usb_submit_urb failed with result -19 [ 572.767427][ T1246] usb 3-1: new high-speed USB device number 35 using dummy_hcd [ 572.936473][ T1246] usb 3-1: Using ep0 maxpacket: 32 [ 572.986548][ T1246] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 572.986584][ T1246] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 572.986624][ T1246] usb 3-1: New USB device found, idVendor=046d, idProduct=c31c, bcdDevice= 0.40 [ 572.986648][ T1246] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 573.006830][ T5614] Bluetooth: hci4: command tx timeout [ 573.061716][ T1246] usb 3-1: config 0 descriptor?? [ 573.085962][ T1246] hub 3-1:0.0: USB hub found [ 573.379108][ T1246] hub 3-1:0.0: 1 port detected [ 573.796542][T11749] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 573.798434][T11749] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 573.918900][ T37] kauditd_printk_skb: 10611 callbacks suppressed [ 573.918920][ T37] audit: type=1400 audit(1785612287.163:165598): lsm=SMACK fn=smack_inode_permission action=granted subject="_" object="_" requested=x pid=4963 comm="udevd" name="loop1" dev="sysfs" ino=15263 [ 573.923529][ T37] audit: type=1400 audit(1785612287.163:165599): lsm=SMACK fn=smack_socket_sock_rcv_skb action=granted subject="_" object="_" requested=w pid=1200 comm="irq/31-virtio1-" saddr=10.128.0.169 src=30008 daddr=10.128.1.138 dest=49538 netif=eth0 [ 573.981783][ T37] audit: type=1400 audit(1785612287.163:165600): lsm=SMACK fn=smack_socket_sock_rcv_skb action=granted subject="_" object="_" requested=w pid=1200 comm="irq/31-virtio1-" saddr=10.128.0.169 src=30008 daddr=10.128.1.138 dest=49538 netif=eth0 [ 573.981845][ T37] audit: type=1400 audit(1785612287.163:165601): lsm=SMACK fn=smack_inode_permission action=granted subject="_" object="_" requested=x pid=5604 comm="syz-executor" name="newroot" dev="tmpfs" ino=2 [ 573.981891][ T37] audit: type=1400 audit(1785612287.163:165602): lsm=SMACK fn=smack_inode_permission action=granted subject="_" object="_" requested=x pid=5604 comm="syz-executor" name="newroot" dev="tmpfs" ino=2 [ 573.981937][ T37] audit: type=1400 audit(1785612287.183:165603): lsm=SMACK fn=smack_inode_getattr action=granted subject="_" object="_" requested=r pid=4963 comm="udevd" path="/sys/devices/virtual/block/loop1/uevent" dev="sysfs" ino=15264 [ 573.981984][ T37] audit: type=1400 audit(1785612287.183:165604): lsm=SMACK fn=smack_inode_permission action=granted subject="_" object="_" requested=x pid=4963 comm="udevd" name="/" dev="sda1" ino=2 [ 573.982027][ T37] audit: type=1400 audit(1785612287.193:165605): lsm=SMACK fn=smack_inode_permission action=granted subject="_" object="_" requested=x pid=4963 comm="udevd" name="/" dev="sysfs" ino=1 [ 573.982071][ T37] audit: type=1400 audit(1785612287.193:165606): lsm=SMACK fn=smack_inode_permission action=granted subject="_" object="_" requested=x pid=4963 comm="udevd" name="devices" dev="sysfs" ino=18 [ 573.982116][ T37] audit: type=1400 audit(1785612287.203:165607): lsm=SMACK fn=smack_inode_permission action=granted subject="_" object="_" requested=x pid=4963 comm="udevd" name="virtual" dev="sysfs" ino=1389 [ 574.398180][T11779] FAULT_INJECTION: forcing a failure. [ 574.398180][T11779] name failslab, interval 1, probability 0, space 0, times 0 [ 574.398214][T11779] CPU: 1 UID: 0 PID: 11779 Comm: syz.0.2123 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 574.398239][T11779] Tainted: [L]=SOFTLOCKUP [ 574.398246][T11779] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 574.398257][T11779] Call Trace: [ 574.398264][T11779] [ 574.398271][T11779] dump_stack_lvl+0xe8/0x150 [ 574.398307][T11779] should_fail_ex+0x467/0x600 [ 574.398340][T11779] should_failslab+0xa8/0x100 [ 574.398365][T11779] __kmalloc_noprof+0xfe/0x780 [ 574.398384][T11779] ? rcu_is_watching+0x15/0xb0 [ 574.398408][T11779] ? tomoyo_realpath_from_path+0xef/0x640 [ 574.398433][T11779] ? tomoyo_realpath_from_path+0xef/0x640 [ 574.398494][T11779] tomoyo_realpath_from_path+0xef/0x640 [ 574.398528][T11779] ? tomoyo_path_number_perm+0x219/0x5f0 [ 574.398549][T11779] tomoyo_path_number_perm+0x246/0x5f0 [ 574.398573][T11779] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 574.398597][T11779] ? sb_end_write+0xe5/0x190 [ 574.398616][T11779] ? vfs_write+0x9e0/0xbb0 [ 574.398644][T11779] ? hook_file_ioctl+0x1f3/0x600 [ 574.398692][T11779] ? ksys_write+0x202/0x270 [ 574.398722][T11779] security_file_ioctl+0xc3/0x2a0 [ 574.398748][T11779] __se_sys_ioctl+0x47/0x170 [ 574.398775][T11779] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 574.398797][T11779] do_syscall_64+0x174/0x580 [ 574.398825][T11779] ? trace_irq_disable+0x3b/0x140 [ 574.398844][T11779] ? clear_bhb_loop+0x40/0x90 [ 574.398869][T11779] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 574.398887][T11779] RIP: 0033:0x7ffa0d6ce019 [ 574.398906][T11779] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 574.398924][T11779] RSP: 002b:00007ffa0b926028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 574.398945][T11779] RAX: ffffffffffffffda RBX: 00007ffa0d955fa0 RCX: 00007ffa0d6ce019 [ 574.398971][T11779] RDX: 000000000000001f RSI: 0000000000005760 RDI: 0000000000000005 [ 574.398984][T11779] RBP: 00007ffa0b926090 R08: 0000000000000000 R09: 0000000000000000 [ 574.398997][T11779] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 574.399009][T11779] R13: 00007ffa0d956038 R14: 00007ffa0d955fa0 R15: 00007ffd2e465b68 [ 574.399043][T11779] [ 574.399067][T11779] ERROR: Out of memory at tomoyo_realpath_from_path. [ 574.432444][ T1246] usb 3-1: USB disconnect, device number 35 [ 575.081748][ T5614] Bluetooth: hci4: command tx timeout [ 576.126515][ T1246] usb 3-1: new high-speed USB device number 36 using dummy_hcd [ 576.306466][ T1246] usb 3-1: Using ep0 maxpacket: 16 [ 576.310971][ T1246] usb 3-1: config index 0 descriptor too short (expected 51443, got 18) [ 576.385494][ T1246] usb 3-1: New USB device found, idVendor=17ef, idProduct=721e, bcdDevice=de.06 [ 576.385528][ T1246] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 576.385551][ T1246] usb 3-1: Product: syz [ 576.385566][ T1246] usb 3-1: Manufacturer: syz [ 576.385670][ T1246] usb 3-1: SerialNumber: syz [ 576.509995][ T1246] r8152-cfgselector 3-1: Unknown version 0x0000 [ 576.510023][ T1246] r8152-cfgselector 3-1: config 0 descriptor?? [ 577.006477][ T1246] r8152-cfgselector 3-1: USB disconnect, device number 36 [ 577.159872][ T5614] Bluetooth: hci4: command tx timeout [ 577.240356][ T821] usb 4-1: new high-speed USB device number 49 using dummy_hcd [ 577.389603][ T821] usb 4-1: Using ep0 maxpacket: 16 [ 577.437061][T11827] kvm: kvm [11826]: vcpu0, guest rIP: 0x18e Unhandled WRMSR(0xc1) = 0x100000080 [ 577.444224][T11827] kvm: kvm [11826]: vcpu0, guest rIP: 0x18e Unhandled WRMSR(0x11e) = 0x0 [ 577.444314][T11827] kvm: kvm [11826]: vcpu0, guest rIP: 0x1b8 Unhandled WRMSR(0x11e) = 0xbe702111 [ 577.455704][ T821] usb 4-1: config index 0 descriptor too short (expected 51443, got 18) [ 577.514915][ T821] usb 4-1: New USB device found, idVendor=17ef, idProduct=721e, bcdDevice=de.06 [ 577.514949][ T821] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 577.514975][ T821] usb 4-1: Product: syz [ 577.514991][ T821] usb 4-1: Manufacturer: syz [ 577.515007][ T821] usb 4-1: SerialNumber: syz [ 577.574486][ T821] r8152-cfgselector 4-1: Unknown version 0x0000 [ 577.574512][ T821] r8152-cfgselector 4-1: config 0 descriptor?? [ 578.175659][ T9] r8152-cfgselector 4-1: USB disconnect, device number 49 [ 578.321704][T11844] FAULT_INJECTION: forcing a failure. [ 578.321704][T11844] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 578.321740][T11844] CPU: 1 UID: 0 PID: 11844 Comm: syz.2.2140 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 578.321766][T11844] Tainted: [L]=SOFTLOCKUP [ 578.321773][T11844] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 578.321785][T11844] Call Trace: [ 578.321793][T11844] [ 578.321802][T11844] dump_stack_lvl+0xe8/0x150 [ 578.321843][T11844] should_fail_ex+0x467/0x600 [ 578.321883][T11844] _copy_from_user+0x2d/0xb0 [ 578.321906][T11844] ____sys_sendmsg+0x31b/0x870 [ 578.321930][T11844] ? __might_fault+0xaf/0x130 [ 578.321954][T11844] ? __pfx_____sys_sendmsg+0x10/0x10 [ 578.321983][T11844] ? import_iovec+0x73/0xa0 [ 578.322007][T11844] ___sys_sendmsg+0x2a5/0x360 [ 578.322028][T11844] ? __lock_acquire+0x683/0x2ce0 [ 578.322052][T11844] ? __pfx____sys_sendmsg+0x10/0x10 [ 578.322101][T11844] ? __fget_files+0x2a/0x420 [ 578.322124][T11844] ? __fget_files+0x3a8/0x420 [ 578.322152][T11844] __x64_sys_sendmsg+0x1b7/0x290 [ 578.322179][T11844] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 578.322221][T11844] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 578.322243][T11844] do_syscall_64+0x174/0x580 [ 578.322268][T11844] ? trace_irq_disable+0x3b/0x140 [ 578.322288][T11844] ? clear_bhb_loop+0x40/0x90 [ 578.322312][T11844] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 578.322333][T11844] RIP: 0033:0x7f223d68e019 [ 578.322352][T11844] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 578.322369][T11844] RSP: 002b:00007f223b8c5028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 578.322389][T11844] RAX: ffffffffffffffda RBX: 00007f223d916090 RCX: 00007f223d68e019 [ 578.322404][T11844] RDX: 0000000000000000 RSI: 0000200000000140 RDI: 0000000000000003 [ 578.322432][T11844] RBP: 00007f223b8c5090 R08: 0000000000000000 R09: 0000000000000000 [ 578.322445][T11844] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 578.322456][T11844] R13: 00007f223d916128 R14: 00007f223d916090 R15: 00007fff1f02b5a8 [ 578.322484][T11844] [ 578.927255][ T37] kauditd_printk_skb: 9571 callbacks suppressed [ 578.927275][ T37] audit: type=1400 audit(1785612292.163:174966): lsm=SMACK fn=smack_inode_permission action=granted subject="_" object="_" requested=x pid=11448 comm="udevd" name="/" dev="sda1" ino=2 [ 578.927324][ T37] audit: type=1400 audit(1785612292.163:174967): lsm=SMACK fn=smack_inode_permission action=granted subject="_" object="_" requested=x pid=11448 comm="udevd" name="/" dev="sysfs" ino=1 [ 578.927369][ T37] audit: type=1400 audit(1785612292.163:174968): lsm=SMACK fn=smack_inode_permission action=granted subject="_" object="_" requested=x pid=11448 comm="udevd" name="devices" dev="sysfs" ino=18 [ 578.927414][ T37] audit: type=1400 audit(1785612292.163:174969): lsm=SMACK fn=smack_inode_permission action=granted subject="_" object="_" requested=x pid=11448 comm="udevd" name="platform" dev="sysfs" ino=48 [ 578.927459][ T37] audit: type=1400 audit(1785612292.163:174970): lsm=SMACK fn=smack_inode_permission action=granted subject="_" object="_" requested=x pid=11448 comm="udevd" name="/" dev="sda1" ino=2 [ 578.927503][ T37] audit: type=1400 audit(1785612292.163:174971): lsm=SMACK fn=smack_inode_permission action=granted subject="_" object="_" requested=x pid=11448 comm="udevd" name="/" dev="sysfs" ino=1 [ 578.927548][ T37] audit: type=1400 audit(1785612292.163:174972): lsm=SMACK fn=smack_inode_permission action=granted subject="_" object="_" requested=x pid=11448 comm="udevd" name="devices" dev="sysfs" ino=18 [ 578.927595][ T37] audit: type=1400 audit(1785612292.163:174973): lsm=SMACK fn=smack_inode_permission action=granted subject="_" object="_" requested=x pid=11448 comm="udevd" name="platform" dev="sysfs" ino=48 [ 578.927647][ T37] audit: type=1400 audit(1785612292.163:174974): lsm=SMACK fn=smack_inode_permission action=granted subject="_" object="_" requested=x pid=11448 comm="udevd" name="dummy_hcd.2" dev="sysfs" ino=26712 [ 578.927694][ T37] audit: type=1400 audit(1785612292.173:174975): lsm=SMACK fn=smack_inode_permission action=granted subject="_" object="_" requested=x pid=11445 comm="udevd" name="dummy_hcd.2" dev="sysfs" ino=26712 [ 579.238593][ T5614] Bluetooth: hci4: command tx timeout [ 579.502775][T11858] FAULT_INJECTION: forcing a failure. [ 579.502775][T11858] name failslab, interval 1, probability 0, space 0, times 0 [ 579.502809][T11858] CPU: 0 UID: 0 PID: 11858 Comm: syz.3.2145 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 579.502834][T11858] Tainted: [L]=SOFTLOCKUP [ 579.502841][T11858] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 579.502852][T11858] Call Trace: [ 579.502859][T11858] [ 579.502867][T11858] dump_stack_lvl+0xe8/0x150 [ 579.502902][T11858] should_fail_ex+0x467/0x600 [ 579.502938][T11858] should_failslab+0xa8/0x100 [ 579.502963][T11858] __kmalloc_noprof+0xfe/0x780 [ 579.502985][T11858] ? tomoyo_encode+0x2ad/0x570 [ 579.503008][T11858] ? tomoyo_encode+0x2ad/0x570 [ 579.503035][T11858] tomoyo_encode+0x2ad/0x570 [ 579.503066][T11858] tomoyo_realpath_from_path+0x5fa/0x640 [ 579.503098][T11858] ? tomoyo_path_number_perm+0x219/0x5f0 [ 579.503118][T11858] tomoyo_path_number_perm+0x246/0x5f0 [ 579.503142][T11858] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 579.503167][T11858] ? __lock_acquire+0x683/0x2ce0 [ 579.503200][T11858] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 579.503226][T11858] ? hook_file_ioctl+0x1f3/0x600 [ 579.503257][T11858] ? lockdep_hardirqs_on+0x7a/0x110 [ 579.503298][T11858] ? __fget_files+0x2a/0x420 [ 579.503323][T11858] ? __fget_files+0x2a/0x420 [ 579.503343][T11858] ? __fget_files+0x3a8/0x420 [ 579.503365][T11858] ? __fget_files+0x2a/0x420 [ 579.503391][T11858] security_file_ioctl+0xc3/0x2a0 [ 579.503416][T11858] __se_sys_ioctl+0x47/0x170 [ 579.503443][T11858] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 579.503465][T11858] do_syscall_64+0x174/0x580 [ 579.503490][T11858] ? trace_irq_disable+0x3b/0x140 [ 579.503510][T11858] ? clear_bhb_loop+0x40/0x90 [ 579.503536][T11858] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 579.503566][T11858] RIP: 0033:0x7f2d52dce019 [ 579.503587][T11858] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 579.503606][T11858] RSP: 002b:00007f2d51005028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 579.503630][T11858] RAX: ffffffffffffffda RBX: 00007f2d53056090 RCX: 00007f2d52dce019 [ 579.503647][T11858] RDX: 0000200000000140 RSI: 00000000c0105500 RDI: 0000000000000003 [ 579.503662][T11858] RBP: 00007f2d51005090 R08: 0000000000000000 R09: 0000000000000000 [ 579.503681][T11858] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 579.503695][T11858] R13: 00007f2d53056128 R14: 00007f2d53056090 R15: 00007fff6c9f7e08 [ 579.503730][T11858] [ 579.505446][T11858] ERROR: Out of memory at tomoyo_realpath_from_path. [ 579.840657][T11861] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2147'. [ 579.840678][T11861] netlink: 4 bytes leftover after parsing attributes in process `syz.2.2147'. [ 581.071251][T11881] netlink: 12 bytes leftover after parsing attributes in process `syz.3.2148'. [ 583.454635][T11910] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2163'. [ 583.607788][T11914] macsec1: entered promiscuous mode [ 583.607810][T11914] virt_wifi0: entered promiscuous mode [ 583.936376][ T37] kauditd_printk_skb: 11107 callbacks suppressed [ 583.936397][ T37] audit: type=1400 audit(1785612297.173:184367): lsm=SMACK fn=smack_inode_permission action=granted subject="_" object="_" requested=x pid=4963 comm="udevd" name="block" dev="sysfs" ino=13350 [ 583.936441][ T37] audit: type=1400 audit(1785612297.173:184368): lsm=SMACK fn=smack_inode_permission action=granted subject="_" object="_" requested=x pid=4963 comm="udevd" name="/" dev="sda1" ino=2 [ 583.936483][ T37] audit: type=1400 audit(1785612297.173:184369): lsm=SMACK fn=smack_inode_permission action=granted subject="_" object="_" requested=x pid=4963 comm="udevd" name="/" dev="sysfs" ino=1 [ 583.936527][ T37] audit: type=1400 audit(1785612297.173:184370): lsm=SMACK fn=smack_inode_permission action=granted subject="_" object="_" requested=x pid=4963 comm="udevd" name="devices" dev="sysfs" ino=18 [ 583.936571][ T37] audit: type=1400 audit(1785612297.173:184371): lsm=SMACK fn=smack_inode_permission action=granted subject="_" object="_" requested=x pid=4963 comm="udevd" name="virtual" dev="sysfs" ino=1389 [ 583.936614][ T37] audit: type=1400 audit(1785612297.173:184372): lsm=SMACK fn=smack_inode_permission action=granted subject="_" object="_" requested=x pid=4963 comm="udevd" name="block" dev="sysfs" ino=13350 [ 583.936658][ T37] audit: type=1400 audit(1785612297.173:184373): lsm=SMACK fn=smack_inode_permission action=granted subject="_" object="_" requested=x pid=4963 comm="udevd" name="loop1" dev="sysfs" ino=15263 [ 583.938613][ T37] audit: type=1400 audit(1785612297.173:184374): lsm=SMACK fn=smack_inode_getattr action=granted subject="_" object="_" requested=r pid=4963 comm="udevd" path="/sys/devices/virtual/block/loop1/uevent" dev="sysfs" ino=15264 [ 583.938665][ T37] audit: type=1400 audit(1785612297.183:184375): lsm=SMACK fn=smack_inode_permission action=granted subject="_" object="_" requested=x pid=4963 comm="udevd" name="/" dev="sda1" ino=2 [ 583.942087][ T37] audit: type=1400 audit(1785612297.183:184376): lsm=SMACK fn=smack_inode_permission action=granted subject="_" object="_" requested=x pid=4963 comm="udevd" name="/" dev="sysfs" ino=1 [ 584.615582][T11937] netlink: 12 bytes leftover after parsing attributes in process `syz.1.2167'. [ 585.429830][T11935] sctp: [Deprecated]: syz.3.2173 (pid 11935) Use of struct sctp_assoc_value in delayed_ack socket option. [ 585.429830][T11935] Use struct sctp_sack_info instead [ 585.602446][T11944] FAULT_INJECTION: forcing a failure. [ 585.602446][T11944] name failslab, interval 1, probability 0, space 0, times 0 [ 585.602486][T11944] CPU: 0 UID: 0 PID: 11944 Comm: syz.0.2174 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 585.602517][T11944] Tainted: [L]=SOFTLOCKUP [ 585.602526][T11944] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 585.602540][T11944] Call Trace: [ 585.602550][T11944] [ 585.602560][T11944] dump_stack_lvl+0xe8/0x150 [ 585.602601][T11944] should_fail_ex+0x467/0x600 [ 585.602644][T11944] should_failslab+0xa8/0x100 [ 585.602675][T11944] __kmalloc_noprof+0xfe/0x780 [ 585.602700][T11944] ? rcu_is_watching+0x15/0xb0 [ 585.602729][T11944] ? tomoyo_realpath_from_path+0xef/0x640 [ 585.602761][T11944] ? tomoyo_realpath_from_path+0xef/0x640 [ 585.602801][T11944] tomoyo_realpath_from_path+0xef/0x640 [ 585.602843][T11944] ? tomoyo_path_number_perm+0x219/0x5f0 [ 585.602870][T11944] tomoyo_path_number_perm+0x246/0x5f0 [ 585.602899][T11944] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 585.602924][T11944] ? __lock_acquire+0x683/0x2ce0 [ 585.602963][T11944] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 585.602993][T11944] ? hook_file_ioctl+0x1f3/0x600 [ 585.603028][T11944] ? lockdep_hardirqs_on+0x7a/0x110 [ 585.603077][T11944] ? __fget_files+0x2a/0x420 [ 585.603114][T11944] ? __fget_files+0x2a/0x420 [ 585.603137][T11944] ? __fget_files+0x3a8/0x420 [ 585.603160][T11944] ? __fget_files+0x2a/0x420 [ 585.603189][T11944] security_file_ioctl+0xc3/0x2a0 [ 585.603218][T11944] __se_sys_ioctl+0x47/0x170 [ 585.603251][T11944] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 585.603277][T11944] do_syscall_64+0x174/0x580 [ 585.603306][T11944] ? trace_irq_disable+0x3b/0x140 [ 585.603329][T11944] ? clear_bhb_loop+0x40/0x90 [ 585.603358][T11944] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 585.603381][T11944] RIP: 0033:0x7ffa0d6ce019 [ 585.603403][T11944] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 585.603422][T11944] RSP: 002b:00007ffa0b926028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 585.603446][T11944] RAX: ffffffffffffffda RBX: 00007ffa0d955fa0 RCX: 00007ffa0d6ce019 [ 585.603464][T11944] RDX: 0000200000000180 RSI: 00000000c0d05640 RDI: 0000000000000003 [ 585.603480][T11944] RBP: 00007ffa0b926090 R08: 0000000000000000 R09: 0000000000000000 [ 585.603495][T11944] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 585.603510][T11944] R13: 00007ffa0d956038 R14: 00007ffa0d955fa0 R15: 00007ffd2e465b68 [ 585.603547][T11944] [ 585.603557][T11944] ERROR: Out of memory at tomoyo_realpath_from_path. [ 586.210319][ T5614] Bluetooth: Frame is too long (len 18, expected len 4) [ 586.576683][ T43] bridge_slave_1: left allmulticast mode [ 586.576718][ T43] bridge_slave_1: left promiscuous mode [ 586.577018][ T43] bridge0: port 2(bridge_slave_1) entered disabled state [ 586.923184][ T43] bridge_slave_0: left allmulticast mode [ 586.923221][ T43] bridge_slave_0: left promiscuous mode [ 586.923505][ T43] bridge0: port 1(bridge_slave_0) entered disabled state [ 587.146525][T11980] netlink: zone id is out of range [ 587.146543][T11980] netlink: zone id is out of range [ 587.146552][T11980] netlink: zone id is out of range [ 587.146562][T11980] netlink: zone id is out of range [ 587.146571][T11980] netlink: zone id is out of range [ 587.146581][T11980] netlink: zone id is out of range [ 587.146590][T11980] netlink: zone id is out of range [ 587.146599][T11980] netlink: zone id is out of range [ 587.146609][T11980] netlink: zone id is out of range [ 587.146618][T11980] netlink: zone id is out of range [ 587.822382][T11992] FAULT_INJECTION: forcing a failure. [ 587.822382][T11992] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 587.822423][T11992] CPU: 0 UID: 0 PID: 11992 Comm: syz.0.2189 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 587.822458][T11992] Tainted: [L]=SOFTLOCKUP [ 587.822467][T11992] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 587.822482][T11992] Call Trace: [ 587.822491][T11992] [ 587.822501][T11992] dump_stack_lvl+0xe8/0x150 [ 587.822542][T11992] should_fail_ex+0x467/0x600 [ 587.822583][T11992] _copy_from_user+0x2d/0xb0 [ 587.822613][T11992] ucma_bind+0xdc/0x380 [ 587.822650][T11992] ? __pfx_ucma_bind+0x10/0x10 [ 587.822715][T11992] ucma_write+0x257/0x2f0 [ 587.822744][T11992] ? __pfx_ucma_write+0x10/0x10 [ 587.822769][T11992] ? security_file_permission+0x75/0x260 [ 587.822798][T11992] ? rw_verify_area+0x209/0x4d0 [ 587.822833][T11992] vfs_writev+0x4c4/0x990 [ 587.822856][T11992] ? __pfx_ucma_write+0x10/0x10 [ 587.822886][T11992] ? __pfx_vfs_writev+0x10/0x10 [ 587.822923][T11992] ? __fget_files+0x2a/0x420 [ 587.822953][T11992] ? __fget_files+0x3a8/0x420 [ 587.822977][T11992] ? __fget_files+0x2a/0x420 [ 587.823010][T11992] do_writev+0x15a/0x2e0 [ 587.823035][T11992] ? __pfx_do_writev+0x10/0x10 [ 587.823065][T11992] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 587.823091][T11992] do_syscall_64+0x174/0x580 [ 587.823121][T11992] ? trace_irq_disable+0x3b/0x140 [ 587.823162][T11992] ? clear_bhb_loop+0x40/0x90 [ 587.823190][T11992] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 587.823232][T11992] RIP: 0033:0x7ffa0d6ce019 [ 587.823253][T11992] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 587.823273][T11992] RSP: 002b:00007ffa0b926028 EFLAGS: 00000246 ORIG_RAX: 0000000000000014 [ 587.823297][T11992] RAX: ffffffffffffffda RBX: 00007ffa0d955fa0 RCX: 00007ffa0d6ce019 [ 587.823321][T11992] RDX: 0000000000000002 RSI: 0000200000000040 RDI: 0000000000000003 [ 587.823340][T11992] RBP: 00007ffa0b926090 R08: 0000000000000000 R09: 0000000000000000 [ 587.823355][T11992] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 587.823370][T11992] R13: 00007ffa0d956038 R14: 00007ffa0d955fa0 R15: 00007ffd2e465b68 [ 587.823405][T11992] [ 588.247426][T11996] FAULT_INJECTION: forcing a failure. [ 588.247426][T11996] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 588.248980][T11996] CPU: 0 UID: 0 PID: 11996 Comm: syz.1.2191 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 588.249013][T11996] Tainted: [L]=SOFTLOCKUP [ 588.249022][T11996] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 588.249036][T11996] Call Trace: [ 588.249057][T11996] [ 588.249066][T11996] dump_stack_lvl+0xe8/0x150 [ 588.249108][T11996] should_fail_ex+0x467/0x600 [ 588.249149][T11996] _copy_from_user+0x2d/0xb0 [ 588.249178][T11996] memdup_user+0x5e/0xd0 [ 588.249211][T11996] strndup_user+0x68/0xd0 [ 588.249242][T11996] __se_sys_mount+0x9d/0x420 [ 588.249269][T11996] ? ksys_write+0x248/0x270 [ 588.249301][T11996] ? __pfx___se_sys_mount+0x10/0x10 [ 588.249331][T11996] ? __x64_sys_mount+0x20/0xc0 [ 588.249354][T11996] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 588.249379][T11996] do_syscall_64+0x174/0x580 [ 588.249409][T11996] ? trace_irq_disable+0x3b/0x140 [ 588.249431][T11996] ? clear_bhb_loop+0x40/0x90 [ 588.249459][T11996] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 588.249480][T11996] RIP: 0033:0x7fe8cba1e019 [ 588.249501][T11996] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 588.249520][T11996] RSP: 002b:00007fe8c9c76028 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5 [ 588.249544][T11996] RAX: ffffffffffffffda RBX: 00007fe8cbca5fa0 RCX: 00007fe8cba1e019 [ 588.249560][T11996] RDX: 00002000000000c0 RSI: 0000200000000080 RDI: 0000000000000000 [ 588.249576][T11996] RBP: 00007fe8c9c76090 R08: 0000200000000240 R09: 0000000000000000 [ 588.249590][T11996] R10: 0000000000010800 R11: 0000000000000246 R12: 0000000000000001 [ 588.249604][T11996] R13: 00007fe8cbca6038 R14: 00007fe8cbca5fa0 R15: 00007fff31b3a198 [ 588.249639][T11996] [ 588.946813][ T37] kauditd_printk_skb: 10842 callbacks suppressed [ 588.946833][ T37] audit: type=1400 audit(1785612302.193:193830): lsm=SMACK fn=smack_inode_permission action=granted subject="_" object="_" requested=r pid=4963 comm="udevd" name="holders" dev="sysfs" ino=15553 [ 588.947058][ T37] audit: type=1400 audit(1785612302.193:193831): lsm=SMACK fn=smack_file_open action=granted subject="_" object="_" requested=r pid=4963 comm="udevd" path="/sys/devices/virtual/block/loop3/holders" dev="sysfs" ino=15553 [ 588.947346][ T37] audit: type=1400 audit(1785612302.193:193832): lsm=SMACK fn=smack_inode_getattr action=granted subject="_" object="_" requested=r pid=4963 comm="udevd" path="/sys/devices/virtual/block/loop3/holders" dev="sysfs" ino=15553 [ 588.949432][ T37] audit: type=1400 audit(1785612302.193:193833): lsm=SMACK fn=smack_inode_permission action=granted subject="_" object="_" requested=x pid=4963 comm="udevd" name="/" dev="sda1" ino=2 [ 588.949482][ T37] audit: type=1400 audit(1785612302.193:193834): lsm=SMACK fn=smack_inode_permission action=granted subject="_" object="_" requested=x pid=5606 comm="syz-executor" name="newroot" dev="tmpfs" ino=2 [ 588.949531][ T37] audit: type=1400 audit(1785612302.193:193835): lsm=SMACK fn=smack_inode_permission action=granted subject="_" object="_" requested=x pid=4963 comm="udevd" name="/" dev="sysfs" ino=1 [ 588.949973][ T37] audit: type=1400 audit(1785612302.193:193836): lsm=SMACK fn=smack_inode_permission action=granted subject="_" object="_" requested=x pid=4963 comm="udevd" name="devices" dev="sysfs" ino=18 [ 588.950021][ T37] audit: type=1400 audit(1785612302.193:193837): lsm=SMACK fn=smack_inode_permission action=granted subject="_" object="_" requested=x pid=4963 comm="udevd" name="virtual" dev="sysfs" ino=1389 [ 588.950077][ T37] audit: type=1400 audit(1785612302.193:193838): lsm=SMACK fn=smack_socket_sock_rcv_skb action=granted subject="_" object="_" requested=w pid=1200 comm="irq/31-virtio1-" saddr=10.128.0.169 src=30008 daddr=10.128.1.138 dest=49538 netif=eth0 [ 588.951058][ T37] audit: type=1400 audit(1785612302.193:193839): lsm=SMACK fn=smack_socket_sock_rcv_skb action=granted subject="_" object="_" requested=w pid=1200 comm="irq/31-virtio1-" saddr=10.128.0.169 src=30008 daddr=10.128.1.138 dest=49538 netif=eth0 [ 589.855156][T12027] FAULT_INJECTION: forcing a failure. [ 589.855156][T12027] name fail_page_alloc, interval 1, probability 0, space 0, times 0 [ 589.855197][T12027] CPU: 0 UID: 0 PID: 12027 Comm: syz.3.2205 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 589.855225][T12027] Tainted: [L]=SOFTLOCKUP [ 589.855251][T12027] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 589.855265][T12027] Call Trace: [ 589.855278][T12027] [ 589.855288][T12027] dump_stack_lvl+0xe8/0x150 [ 589.855328][T12027] should_fail_ex+0x467/0x600 [ 589.855370][T12027] prepare_alloc_pages+0x223/0x690 [ 589.855406][T12027] __alloc_frozen_pages_noprof+0x12f/0x380 [ 589.855438][T12027] ? __pfx___alloc_frozen_pages_noprof+0x10/0x10 [ 589.855471][T12027] ? __pfx_policy_nodemask+0x10/0x10 [ 589.855500][T12027] ? reacquire_held_locks+0x104/0x190 [ 589.855539][T12027] alloc_pages_mpol+0xce/0x280 [ 589.855582][T12027] alloc_pages_noprof+0xd2/0x2f0 [ 589.855621][T12027] __pmd_alloc+0x3a/0x5e0 [ 589.855650][T12027] handle_mm_fault+0xeb1/0x13f0 [ 589.855682][T12027] ? handle_mm_fault+0xe8/0x13f0 [ 589.855707][T12027] ? __pfx_handle_mm_fault+0x10/0x10 [ 589.855745][T12027] ? __lock_acquire+0x683/0x2ce0 [ 589.855772][T12027] ? lock_mm_and_find_vma+0xa7/0x340 [ 589.855804][T12027] do_user_addr_fault+0x744/0x1340 [ 589.855842][T12027] exc_page_fault+0x6a/0xc0 [ 589.855873][T12027] asm_exc_page_fault+0x26/0x30 [ 589.855894][T12027] RIP: 0010:rep_movs_alternative+0x4a/0xa0 [ 589.855918][T12027] Code: 2a 05 00 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 00 48 8b 06 48 89 07 48 83 c6 08 48 83 c7 08 83 e9 08 74 db 83 f9 08 73 e8 eb c5 a4 c3 cc cc cc cc 48 8b 06 48 89 07 48 8d 47 08 48 83 e0 f8 48 [ 589.855938][T12027] RSP: 0018:ffffc90006127d78 EFLAGS: 00050246 [ 589.855958][T12027] RAX: 00007ffffffff001 RBX: 0000000000000040 RCX: 0000000000000040 [ 589.855973][T12027] RDX: 0000000000000001 RSI: 00002000000003c0 RDI: ffffc90006127e20 [ 589.855989][T12027] RBP: ffffc90006127ee0 R08: ffffc90006127e5f R09: 1ffff92000c24fcb [ 589.856005][T12027] R10: dffffc0000000000 R11: fffff52000c24fcc R12: ffffc90006127e20 [ 589.856022][T12027] R13: 00002000000003c0 R14: ffffc90006127e20 R15: 00002000000003c0 [ 589.856073][T12027] _copy_from_user+0x7a/0xb0 [ 589.856103][T12027] __se_sys_io_uring_register+0x1bc/0x1a20 [ 589.856136][T12027] ? __pfx___se_sys_io_uring_register+0x10/0x10 [ 589.856164][T12027] ? ksys_write+0x248/0x270 [ 589.856211][T12027] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 589.856236][T12027] do_syscall_64+0x174/0x580 [ 589.856265][T12027] ? trace_irq_disable+0x3b/0x140 [ 589.856288][T12027] ? clear_bhb_loop+0x40/0x90 [ 589.856317][T12027] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 589.856341][T12027] RIP: 0033:0x7f2d52dce019 [ 589.856361][T12027] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 589.856380][T12027] RSP: 002b:00007f2d51026028 EFLAGS: 00000246 ORIG_RAX: 00000000000001ab [ 589.856403][T12027] RAX: ffffffffffffffda RBX: 00007f2d53055fa0 RCX: 00007f2d52dce019 [ 589.856419][T12027] RDX: 00002000000003c0 RSI: 000000000000001f RDI: ffffffffffffffff [ 589.856436][T12027] RBP: 00007f2d51026090 R08: 0000000000000000 R09: 0000000000000000 [ 589.856451][T12027] R10: 0000000000000001 R11: 0000000000000246 R12: 0000000000000001 [ 589.856465][T12027] R13: 00007f2d53056038 R14: 00007f2d53055fa0 R15: 00007fff6c9f7e08 [ 589.856514][T12027] [ 589.892881][ T43] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 590.252275][ T43] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 590.309209][ T43] bond0 (unregistering): Released all slaves [ 590.648330][T11729] bridge0: port 1(bridge_slave_0) entered blocking state [ 590.648696][T11729] bridge0: port 1(bridge_slave_0) entered disabled state [ 590.648932][T11729] bridge_slave_0: entered allmulticast mode [ 590.699236][T11729] bridge_slave_0: entered promiscuous mode [ 590.727616][T11729] bridge0: port 2(bridge_slave_1) entered blocking state [ 590.729359][T11729] bridge0: port 2(bridge_slave_1) entered disabled state [ 590.729605][T11729] bridge_slave_1: entered allmulticast mode [ 590.795598][T11729] bridge_slave_1: entered promiscuous mode [ 590.921629][T12040] binder: BINDER_SET_CONTEXT_MGR already set [ 590.921646][T12040] binder: 12039:12040 ioctl 4018620d 200000000040 returned -16 [ 591.255535][T11729] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 591.457478][ T43] hsr_slave_0: left promiscuous mode [ 591.499961][ T43] hsr_slave_1: left promiscuous mode [ 591.501034][ T43] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 591.546512][ T43] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 592.799694][ T5614] Bluetooth: hci0: unexpected event for opcode 0x0000 [ 593.958026][ T37] kauditd_printk_skb: 15083 callbacks suppressed [ 593.958045][ T37] audit: type=1400 audit(1785612307.193:207926): lsm=SMACK fn=smack_inode_permission action=granted subject="_" object="_" requested=w pid=4963 comm="udevd" name="queue" dev="tmpfs" ino=6916 [ 593.958089][ T37] audit: type=1400 audit(1785612307.193:207927): lsm=SMACK fn=smack_inode_permission action=granted subject="_" object="_" requested=x pid=11448 comm="udevd" name="devices" dev="sysfs" ino=18 [ 593.958130][ T37] audit: type=1400 audit(1785612307.193:207929): lsm=SMACK fn=smack_inode_permission action=granted subject="_" object="_" requested=wx pid=11469 comm="udevd" name="data" dev="tmpfs" ino=14 [ 593.958172][ T37] audit: type=1400 audit(1785612307.203:207930): lsm=SMACK fn=smack_inode_permission action=granted subject="_" object="_" requested=x pid=11448 comm="udevd" name="virtual" dev="sysfs" ino=1389 [ 593.958214][ T37] audit: type=1400 audit(1785612307.203:207931): lsm=SMACK fn=smack_inode_permission action=granted subject="_" object="_" requested=x pid=11448 comm="udevd" name="misc" dev="sysfs" ino=3746 [ 593.958255][ T37] audit: type=1400 audit(1785612307.203:207932): lsm=SMACK fn=smack_inode_permission action=granted subject="_" object="_" requested=x pid=11448 comm="udevd" name="kvm" dev="sysfs" ino=4945 [ 593.958298][ T37] audit: type=1400 audit(1785612307.203:207933): lsm=SMACK fn=smack_inode_permission action=granted subject="_" object="_" requested=r pid=11448 comm="udevd" name="uevent" dev="sysfs" ino=4946 [ 593.958340][ T37] audit: type=1400 audit(1785612307.203:207934): lsm=SMACK fn=smack_file_open action=granted subject="_" object="_" requested=r pid=11448 comm="udevd" path="/sys/devices/virtual/misc/kvm/uevent" dev="sysfs" ino=4946 [ 593.958395][ T37] audit: type=1400 audit(1785612307.203:207935): lsm=SMACK fn=smack_inode_getattr action=granted subject="_" object="_" requested=r pid=11448 comm="udevd" path="/sys/devices/virtual/misc/kvm/uevent" dev="sysfs" ino=4946 [ 593.958435][ T37] audit: type=1400 audit(1785612307.203:207936): lsm=SMACK fn=smack_inode_permission action=granted subject="_" object="_" requested=x pid=11448 comm="udevd" name="/" dev="sda1" ino=2 [ 594.237853][ T43] team0 (unregistering): Port device team_slave_1 removed [ 594.339751][ T43] team0 (unregistering): Port device team_slave_0 removed [ 594.478564][ T5614] Bluetooth: hci0: unexpected event for opcode 0x0004 [ 595.004257][T11729] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 595.004341][T12056] netlink: 774 bytes leftover after parsing attributes in process `syz.3.2216'. [ 595.004374][T12056] netlink: 'syz.3.2216': attribute type 1 has an invalid length. [ 595.226848][T12075] sch_tbf: burst 4 is lower than device lo mtu (65550) ! [ 595.232692][ T5258] 8021q: adding VLAN 0 to HW filter on device eth1 [ 595.517102][T11729] team0: Port device team_slave_0 added [ 595.521239][T11729] team0: Port device team_slave_1 added [ 595.727587][T11729] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 595.727613][T11729] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 595.727643][T11729] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 595.733865][T11729] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 595.733881][T11729] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 595.733911][T11729] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 596.355733][ T5614] Bluetooth: hci0: Malformed Event: 0x2f [ 596.958149][T12156] FAULT_INJECTION: forcing a failure. [ 596.958149][T12156] name failslab, interval 1, probability 0, space 0, times 0 [ 596.958188][T12156] CPU: 0 UID: 0 PID: 12156 Comm: syz.0.2252 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 596.958219][T12156] Tainted: [L]=SOFTLOCKUP [ 596.958227][T12156] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 596.958241][T12156] Call Trace: [ 596.958250][T12156] [ 596.958259][T12156] dump_stack_lvl+0xe8/0x150 [ 596.958299][T12156] should_fail_ex+0x467/0x600 [ 596.958340][T12156] should_failslab+0xa8/0x100 [ 596.958369][T12156] __kmalloc_noprof+0xfe/0x780 [ 596.958392][T12156] ? rcu_is_watching+0x15/0xb0 [ 596.958419][T12156] ? tomoyo_realpath_from_path+0xef/0x640 [ 596.958448][T12156] ? tomoyo_realpath_from_path+0xef/0x640 [ 596.958486][T12156] tomoyo_realpath_from_path+0xef/0x640 [ 596.958527][T12156] ? tomoyo_path_number_perm+0x219/0x5f0 [ 596.958571][T12156] tomoyo_path_number_perm+0x246/0x5f0 [ 596.958601][T12156] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 596.958625][T12156] ? __lock_acquire+0x683/0x2ce0 [ 596.958664][T12156] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 596.958693][T12156] ? hook_file_ioctl+0x1f3/0x600 [ 596.958727][T12156] ? lockdep_hardirqs_on+0x7a/0x110 [ 596.958776][T12156] ? __fget_files+0x2a/0x420 [ 596.958804][T12156] ? __fget_files+0x2a/0x420 [ 596.958827][T12156] ? __fget_files+0x3a8/0x420 [ 596.958850][T12156] ? __fget_files+0x2a/0x420 [ 596.958879][T12156] security_file_ioctl+0xc3/0x2a0 [ 596.958908][T12156] __se_sys_ioctl+0x47/0x170 [ 596.958940][T12156] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 596.958964][T12156] do_syscall_64+0x174/0x580 [ 596.958993][T12156] ? trace_irq_disable+0x3b/0x140 [ 596.959017][T12156] ? clear_bhb_loop+0x40/0x90 [ 596.959045][T12156] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 596.959068][T12156] RIP: 0033:0x7ffa0d6ce019 [ 596.959089][T12156] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 596.959108][T12156] RSP: 002b:00007ffa0b926028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 596.959133][T12156] RAX: ffffffffffffffda RBX: 00007ffa0d955fa0 RCX: 00007ffa0d6ce019 [ 596.959150][T12156] RDX: 0000200000000040 RSI: 0000000000005412 RDI: 0000000000000003 [ 596.959165][T12156] RBP: 00007ffa0b926090 R08: 0000000000000000 R09: 0000000000000000 [ 596.959179][T12156] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 596.959191][T12156] R13: 00007ffa0d956038 R14: 00007ffa0d955fa0 R15: 00007ffd2e465b68 [ 596.959230][T12156] [ 596.959250][T12156] ERROR: Out of memory at tomoyo_realpath_from_path. [ 596.960852][T12155] [U] ^G [ 598.969663][ T37] kauditd_printk_skb: 8063 callbacks suppressed [ 598.970278][ T37] audit: type=1400 audit(1785612312.193:213257): lsm=SMACK fn=smack_inode_permission action=granted subject="_" object="_" requested=x pid=12165 comm="dhcpcd-run-hook" name="var" dev="sda1" ino=2001 [ 598.974550][ T37] audit: type=1400 audit(1785612312.213:213258): lsm=SMACK fn=smack_inode_permission action=granted subject="_" object="_" requested=x pid=12165 comm="dhcpcd-run-hook" name="/" dev="sda1" ino=2 [ 599.024818][ T37] audit: type=1400 audit(1785612312.263:213259): lsm=SMACK fn=smack_inode_permission action=granted subject="_" object="_" requested=x pid=12165 comm="dhcpcd-run-hook" name="/" dev="tmpfs" ino=1 [ 599.061250][ T37] audit: type=1400 audit(1785612312.303:213260): lsm=SMACK fn=smack_inode_permission action=granted subject="_" object="_" requested=x pid=12165 comm="dhcpcd-run-hook" name="dhcpcd" dev="tmpfs" ino=1773 [ 599.063232][ T37] audit: type=1400 audit(1785612312.303:213261): lsm=SMACK fn=smack_inode_permission action=granted subject="_" object="_" requested=x pid=12165 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1777 [ 599.065612][ T37] audit: type=1400 audit(1785612312.303:213262): lsm=SMACK fn=smack_inode_permission action=granted subject="_" object="_" requested=r pid=12165 comm="dhcpcd-run-hook" name="resolv.conf" dev="tmpfs" ino=1778 [ 599.141331][ T37] audit: type=1400 audit(1785612312.383:213263): lsm=SMACK fn=smack_file_open action=granted subject="_" object="_" requested=r pid=12165 comm="dhcpcd-run-hook" path="/run/dhcpcd/hook-state/resolv.conf" dev="tmpfs" ino=1778 [ 599.145505][ T37] audit: type=1400 audit(1785612312.383:213264): lsm=SMACK fn=smack_inode_getattr action=granted subject="_" object="_" requested=r pid=12165 comm="dhcpcd-run-hook" path="/run/dhcpcd/hook-state/resolv.conf" dev="tmpfs" ino=1778 [ 599.203966][ T37] audit: type=1400 audit(1785612312.443:213265): lsm=SMACK fn=smack_inode_permission action=granted subject="_" object="_" requested=x pid=12165 comm="dhcpcd-run-hook" name="/" dev="sda1" ino=2 [ 599.229444][ T37] audit: type=1400 audit(1785612312.443:213266): lsm=SMACK fn=smack_inode_permission action=granted subject="_" object="_" requested=x pid=12165 comm="dhcpcd-run-hook" name="var" dev="sda1" ino=2001 [ 599.636660][T11729] hsr_slave_0: entered promiscuous mode [ 599.702968][T11729] hsr_slave_1: entered promiscuous mode [ 599.703682][T11729] debugfs: 'hsr0' already exists in 'hsr' [ 599.703712][T11729] Cannot create hsr debugfs directory [ 600.325253][T12177] bridge1: the hash_elasticity option has been deprecated and is always 16 [ 600.325283][T12177] bridge1: entered allmulticast mode [ 601.175448][T12200] FAULT_INJECTION: forcing a failure. [ 601.175448][T12200] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 601.177166][T12200] CPU: 1 UID: 0 PID: 12200 Comm: syz.1.2263 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 601.177199][T12200] Tainted: [L]=SOFTLOCKUP [ 601.177208][T12200] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 601.177221][T12200] Call Trace: [ 601.177230][T12200] [ 601.177239][T12200] dump_stack_lvl+0xe8/0x150 [ 601.177287][T12200] should_fail_ex+0x467/0x600 [ 601.177328][T12200] _copy_from_user+0x2d/0xb0 [ 601.177358][T12200] restore_altstack+0xae/0x4f0 [ 601.177397][T12200] ? __pfx_rt_mutex_slowunlock+0x10/0x10 [ 601.177427][T12200] ? __pfx_restore_altstack+0x10/0x10 [ 601.177462][T12200] ? rt_spin_unlock+0x157/0x200 [ 601.177489][T12200] ? rt_spin_unlock+0x163/0x200 [ 601.177515][T12200] __ia32_sys_rt_sigreturn+0x2bd/0x8c0 [ 601.177549][T12200] ? __lock_acquire+0x683/0x2ce0 [ 601.177579][T12200] ? __pfx___ia32_sys_rt_sigreturn+0x10/0x10 [ 601.177611][T12200] ? signal_setup_done+0x22f/0x310 [ 601.177644][T12200] ? arch_do_signal_or_restart+0x4f9/0x860 [ 601.177682][T12200] ? __task_pid_nr_ns+0x28/0x470 [ 601.177727][T12200] ? __task_pid_nr_ns+0x28/0x470 [ 601.177769][T12200] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 601.177794][T12200] do_syscall_64+0x174/0x580 [ 601.177826][T12200] ? clear_bhb_loop+0x40/0x90 [ 601.177872][T12200] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 601.177899][T12200] RIP: 0033:0x7fe8cb9bf399 [ 601.177921][T12200] Code: 11 06 00 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 90 66 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 c7 c0 0f 00 00 00 0f 05 <0f> 1f 80 00 00 00 00 48 81 ec 48 01 00 00 49 89 d0 64 48 8b 0c 25 [ 601.177941][T12200] RSP: 002b:00007fe8c9c75a80 EFLAGS: 00000202 ORIG_RAX: 000000000000000f [ 601.177965][T12200] RAX: ffffffffffffffda RBX: 00007fe8cbca5fa0 RCX: 00007fe8cb9bf399 [ 601.177983][T12200] RDX: 00007fe8c9c75a80 RSI: 00007fe8c9c75bb0 RDI: 0000000000000021 [ 601.178000][T12200] RBP: 00007fe8c9c76090 R08: 0000000000000000 R09: 0000000000000000 [ 601.178015][T12200] R10: 0000000000000000 R11: 0000000000000202 R12: 0000000000000001 [ 601.178029][T12200] R13: 00007fe8cbca6038 R14: 00007fe8cbca5fa0 R15: 00007fff31b3a198 [ 601.178064][T12200] [ 601.696391][ T5731] usb 1-1: new full-speed USB device number 25 using dummy_hcd [ 601.826439][ T5731] usb 1-1: device descriptor read/64, error -71 [ 602.053205][T12218] FAULT_INJECTION: forcing a failure. [ 602.053205][T12218] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 602.053243][T12218] CPU: 0 UID: 0 PID: 12218 Comm: syz.2.2268 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 602.053274][T12218] Tainted: [L]=SOFTLOCKUP [ 602.053282][T12218] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 602.053296][T12218] Call Trace: [ 602.053305][T12218] [ 602.053315][T12218] dump_stack_lvl+0xe8/0x150 [ 602.053355][T12218] should_fail_ex+0x467/0x600 [ 602.053397][T12218] _copy_to_user+0x31/0xb0 [ 602.053427][T12218] simple_read_from_buffer+0xe1/0x170 [ 602.053458][T12218] proc_fail_nth_read+0x1be/0x230 [ 602.053488][T12218] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 602.053516][T12218] ? rw_verify_area+0x250/0x4d0 [ 602.053546][T12218] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 602.053573][T12218] vfs_read+0x219/0xa90 [ 602.053609][T12218] ? __pfx_vfs_read+0x10/0x10 [ 602.053646][T12218] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 602.053676][T12218] ? lockdep_hardirqs_on+0x7a/0x110 [ 602.053705][T12218] ? _raw_spin_unlock_irqrestore+0x4c/0x80 [ 602.053735][T12218] ? mutex_lock_nested+0x152/0x1d0 [ 602.053756][T12218] ? fdget_pos+0x252/0x320 [ 602.053788][T12218] ksys_read+0x156/0x270 [ 602.053817][T12218] ? __pfx_ksys_read+0x10/0x10 [ 602.053854][T12218] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 602.053878][T12218] do_syscall_64+0x174/0x580 [ 602.053907][T12218] ? trace_irq_disable+0x3b/0x140 [ 602.053930][T12218] ? clear_bhb_loop+0x40/0x90 [ 602.053957][T12218] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 602.053980][T12218] RIP: 0033:0x7f223d64e84e [ 602.054000][T12218] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 602.054021][T12218] RSP: 002b:00007f223b8c4fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 602.054045][T12218] RAX: ffffffffffffffda RBX: 00007f223b8c56c0 RCX: 00007f223d64e84e [ 602.054062][T12218] RDX: 000000000000000f RSI: 00007f223b8c50a0 RDI: 0000000000000006 [ 602.054077][T12218] RBP: 00007f223b8c5090 R08: 0000000000000000 R09: 0000000000000000 [ 602.054092][T12218] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 602.054106][T12218] R13: 00007f223d916128 R14: 00007f223d916090 R15: 00007fff1f02b5a8 [ 602.054148][T12218] [ 602.066451][ T5731] usb 1-1: new full-speed USB device number 26 using dummy_hcd [ 602.196416][ T5731] usb 1-1: device descriptor read/64, error -71 [ 602.325326][ T5731] usb usb1-port1: attempt power cycle [ 602.418695][ T5258] 8021q: adding VLAN 0 to HW filter on device eth2 [ 602.696435][ T5731] usb 1-1: new full-speed USB device number 27 using dummy_hcd [ 602.724956][ T5731] usb 1-1: device descriptor read/8, error -71 [ 602.976429][ T5731] usb 1-1: new full-speed USB device number 28 using dummy_hcd [ 603.000058][ T5731] usb 1-1: device descriptor read/8, error -71 [ 603.107823][ T5731] usb usb1-port1: unable to enumerate USB device [ 604.116071][ C1] audit_log_start: 11514 callbacks suppressed [ 604.116124][ C1] audit: audit_backlog=65 > audit_backlog_limit=64 [ 604.116170][ C1] audit: audit_lost=14548 audit_rate_limit=0 audit_backlog_limit=64 [ 604.116218][ C1] audit: backlog limit exceeded [ 604.122493][T12246] audit: audit_backlog=65 > audit_backlog_limit=64 [ 604.122537][T12246] audit: audit_lost=14549 audit_rate_limit=0 audit_backlog_limit=64 [ 604.122578][T12246] audit: backlog limit exceeded [ 604.122837][T12246] audit: audit_backlog=65 > audit_backlog_limit=64 [ 604.122875][T12246] audit: audit_lost=14550 audit_rate_limit=0 audit_backlog_limit=64 [ 604.122914][T12246] audit: backlog limit exceeded [ 604.123031][T12246] audit: audit_backlog=65 > audit_backlog_limit=64 [ 604.958908][T12233] FAULT_INJECTION: forcing a failure. [ 604.958908][T12233] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 604.958949][T12233] CPU: 0 UID: 0 PID: 12233 Comm: syz.2.2274 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 604.958981][T12233] Tainted: [L]=SOFTLOCKUP [ 604.959001][T12233] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 604.959014][T12233] Call Trace: [ 604.959022][T12233] [ 604.959031][T12233] dump_stack_lvl+0xe8/0x150 [ 604.959068][T12233] should_fail_ex+0x467/0x600 [ 604.959105][T12233] _copy_from_user+0x2d/0xb0 [ 604.959132][T12233] io_submit_one+0xd2/0x13d0 [ 604.959190][T12233] ? lockdep_hardirqs_on+0x7a/0x110 [ 604.959221][T12233] ? irqentry_exit+0x218/0x8f0 [ 604.959256][T12233] ? __pfx_io_submit_one+0x10/0x10 [ 604.959287][T12233] ? __might_fault+0xaf/0x130 [ 604.959324][T12233] ? __might_fault+0xaf/0x130 [ 604.959351][T12233] __se_sys_io_submit+0x195/0x340 [ 604.959382][T12233] ? __pfx___se_sys_io_submit+0x10/0x10 [ 604.959408][T12233] ? ksys_write+0x248/0x270 [ 604.959452][T12233] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 604.959477][T12233] do_syscall_64+0x174/0x580 [ 604.959506][T12233] ? trace_irq_disable+0x3b/0x140 [ 604.959530][T12233] ? clear_bhb_loop+0x40/0x90 [ 604.959558][T12233] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 604.959580][T12233] RIP: 0033:0x7f223d68e019 [ 604.959601][T12233] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 604.959620][T12233] RSP: 002b:00007f223b8e6028 EFLAGS: 00000246 ORIG_RAX: 00000000000000d1 [ 604.959645][T12233] RAX: ffffffffffffffda RBX: 00007f223d915fa0 RCX: 00007f223d68e019 [ 604.959662][T12233] RDX: 00002000000000c0 RSI: 0000000000000001 RDI: 00007f223e450000 [ 604.959677][T12233] RBP: 00007f223b8e6090 R08: 0000000000000000 R09: 0000000000000000 [ 604.959692][T12233] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 604.959705][T12233] R13: 00007f223d916038 R14: 00007f223d915fa0 R15: 00007fff1f02b5a8 [ 604.959740][T12233] [ 605.756424][ T5730] usb 4-1: new high-speed USB device number 50 using dummy_hcd [ 605.915828][ T5730] usb 4-1: config 27 interface 0 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 7 [ 605.915864][ T5730] usb 4-1: config 27 interface 0 altsetting 0 bulk endpoint 0xB has invalid maxpacket 47 [ 605.915901][ T5730] usb 4-1: New USB device found, idVendor=0582, idProduct=0014, bcdDevice=bb.9d [ 605.915927][ T5730] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 605.971088][T12258] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22 [ 605.991385][ T5730] usb 4-1: Quirk or no altset; falling back to MIDI 1.0 [ 606.620670][ T5715] usb 4-1: USB disconnect, device number 50 [ 607.966449][ T5715] usb 4-1: new high-speed USB device number 51 using dummy_hcd [ 608.116345][ T5715] usb 4-1: Using ep0 maxpacket: 16 [ 608.123527][ T5715] usb 4-1: config index 0 descriptor too short (expected 51443, got 18) [ 608.167834][ T5715] usb 4-1: New USB device found, idVendor=17ef, idProduct=721e, bcdDevice=de.06 [ 608.167867][ T5715] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 608.167888][ T5715] usb 4-1: Product: syz [ 608.167904][ T5715] usb 4-1: Manufacturer: syz [ 608.167920][ T5715] usb 4-1: SerialNumber: syz [ 608.235435][ T5715] r8152-cfgselector 4-1: Unknown version 0x0000 [ 608.235453][ T5715] r8152-cfgselector 4-1: config 0 descriptor?? [ 608.478394][T12290] FAULT_INJECTION: forcing a failure. [ 608.478394][T12290] name fail_page_alloc, interval 1, probability 0, space 0, times 0 [ 608.478434][T12290] CPU: 1 UID: 0 PID: 12290 Comm: syz.0.2285 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 608.478466][T12290] Tainted: [L]=SOFTLOCKUP [ 608.478475][T12290] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 608.478499][T12290] Call Trace: [ 608.478508][T12290] [ 608.478519][T12290] dump_stack_lvl+0xe8/0x150 [ 608.478558][T12290] should_fail_ex+0x467/0x600 [ 608.478607][T12290] prepare_alloc_pages+0x223/0x690 [ 608.478641][T12290] __alloc_frozen_pages_noprof+0x12f/0x380 [ 608.478676][T12290] ? __pfx___alloc_frozen_pages_noprof+0x10/0x10 [ 608.478709][T12290] ? __pfx_policy_nodemask+0x10/0x10 [ 608.478740][T12290] ? __lock_acquire+0x683/0x2ce0 [ 608.478773][T12290] alloc_pages_mpol+0xce/0x280 [ 608.478807][T12290] folio_alloc_mpol_noprof+0x3b/0x1e0 [ 608.478840][T12290] vma_alloc_folio_noprof+0xe1/0x1e0 [ 608.478872][T12290] ? __pfx_vma_alloc_folio_noprof+0x10/0x10 [ 608.478902][T12290] ? __pte_offset_map+0x29/0x200 [ 608.478946][T12290] do_pte_missing+0x835/0x28f0 [ 608.478984][T12290] ? handle_mm_fault+0xe8/0x13f0 [ 608.479012][T12290] handle_mm_fault+0xd28/0x13f0 [ 608.479044][T12290] ? handle_mm_fault+0xe8/0x13f0 [ 608.479069][T12290] ? __pfx_handle_mm_fault+0x10/0x10 [ 608.479106][T12290] ? __lock_acquire+0x683/0x2ce0 [ 608.479136][T12290] ? lock_mm_and_find_vma+0xa7/0x340 [ 608.479167][T12290] do_user_addr_fault+0x744/0x1340 [ 608.479206][T12290] exc_page_fault+0x6a/0xc0 [ 608.479237][T12290] asm_exc_page_fault+0x26/0x30 [ 608.479259][T12290] RIP: 0010:rep_stos_alternative+0x40/0x80 [ 608.479283][T12290] Code: c9 75 f6 e9 42 3b 05 00 48 89 07 48 83 c7 08 83 e9 08 74 ef 83 f9 08 73 ef eb de 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 <48> 89 07 48 89 47 08 48 89 47 10 48 89 47 18 48 89 47 20 48 89 47 [ 608.479302][T12290] RSP: 0018:ffffc90005617c50 EFLAGS: 00050246 [ 608.479323][T12290] RAX: 0000000000000000 RBX: 0000000000b37000 RCX: 0000000000000040 [ 608.479338][T12290] RDX: 0000000000000000 RSI: ffffffff8daf6aa3 RDI: 0000200000b38000 [ 608.479353][T12290] RBP: 0000200000b37040 R08: ffffffff8217a4cf R09: 0000000000000000 [ 608.479369][T12290] R10: 0000000000000000 R11: ffff8880377891b0 R12: dffffc0000000000 [ 608.479384][T12290] R13: 0000000000001000 R14: 000000007f4c8000 R15: 00007ffffffff000 [ 608.479407][T12290] ? __might_fault+0xaf/0x130 [ 608.479440][T12290] read_zero+0x9f/0x1d0 [ 608.479548][T12290] ? __pfx_read_zero+0x10/0x10 [ 608.479579][T12290] vfs_read+0x219/0xa90 [ 608.479617][T12290] ? __pfx_vfs_read+0x10/0x10 [ 608.479649][T12290] ? __fget_files+0x2a/0x420 [ 608.479676][T12290] ? __fget_files+0x2a/0x420 [ 608.479699][T12290] ? __fget_files+0x3a8/0x420 [ 608.479721][T12290] ? __fget_files+0x2a/0x420 [ 608.479755][T12290] ksys_read+0x156/0x270 [ 608.479786][T12290] ? __pfx_ksys_read+0x10/0x10 [ 608.479825][T12290] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 608.479848][T12290] do_syscall_64+0x174/0x580 [ 608.479877][T12290] ? trace_irq_disable+0x3b/0x140 [ 608.479900][T12290] ? clear_bhb_loop+0x40/0x90 [ 608.479927][T12290] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 608.479950][T12290] RIP: 0033:0x7ffa0d6ce019 [ 608.479971][T12290] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 608.479991][T12290] RSP: 002b:00007ffa0b905028 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 608.480013][T12290] RAX: ffffffffffffffda RBX: 00007ffa0d956090 RCX: 00007ffa0d6ce019 [ 608.480029][T12290] RDX: 00000000ffffff96 RSI: 0000200000000040 RDI: 0000000000000003 [ 608.480044][T12290] RBP: 00007ffa0b905090 R08: 0000000000000000 R09: 0000000000000000 [ 608.480057][T12290] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 608.480070][T12290] R13: 00007ffa0d956128 R14: 00007ffa0d956090 R15: 00007ffd2e465b68 [ 608.480106][T12290] [ 609.064372][ T5708] r8152-cfgselector 4-1: USB disconnect, device number 51 [ 609.116410][ T37] kauditd_printk_skb: 11702 callbacks suppressed [ 609.116431][ T37] audit: type=1400 audit(1785612322.353:232641): lsm=SMACK fn=smack_inode_permission action=granted subject="_" object="_" requested=x pid=11469 comm="udevd" name="dummy_udc.3" dev="sysfs" ino=31527 [ 609.116700][ T37] audit: type=1400 audit(1785612322.363:232642): lsm=SMACK fn=smack_inode_permission action=granted subject="_" object="_" requested=r pid=11469 comm="udevd" name="uevent" dev="sysfs" ino=31528 [ 609.117066][ T37] audit: type=1400 audit(1785612322.363:232643): lsm=SMACK fn=smack_file_open action=granted subject="_" object="_" requested=r pid=11469 comm="udevd" path="/sys/devices/platform/dummy_udc.3/udc/dummy_udc.3/uevent" dev="sysfs" ino=31528 [ 609.117407][ T37] audit: type=1400 audit(1785612322.363:232644): lsm=SMACK fn=smack_inode_getattr action=granted subject="_" object="_" requested=r pid=11469 comm="udevd" path="/sys/devices/platform/dummy_udc.3/udc/dummy_udc.3/uevent" dev="sysfs" ino=31528 [ 609.119088][ T37] audit: type=1400 audit(1785612322.363:232645): lsm=SMACK fn=smack_inode_permission action=granted subject="_" object="_" requested=x pid=11448 comm="udevd" name="/" dev="sda1" ino=2 [ 609.119215][ T37] audit: type=1400 audit(1785612322.363:232646): lsm=SMACK fn=smack_inode_permission action=granted subject="_" object="_" requested=x pid=11448 comm="udevd" name="/" dev="sysfs" ino=1 [ 609.119374][ T37] audit: type=1400 audit(1785612322.363:232647): lsm=SMACK fn=smack_inode_permission action=granted subject="_" object="_" requested=x pid=11448 comm="udevd" name="devices" dev="sysfs" ino=18 [ 609.119603][ T37] audit: type=1400 audit(1785612322.363:232648): lsm=SMACK fn=smack_inode_permission action=granted subject="_" object="_" requested=x pid=11448 comm="udevd" name="platform" dev="sysfs" ino=48 [ 609.119715][ T37] audit: type=1400 audit(1785612322.363:232649): lsm=SMACK fn=smack_inode_permission action=granted subject="_" object="_" requested=x pid=11448 comm="udevd" name="dummy_udc.3" dev="sysfs" ino=31512 [ 609.119840][ T37] audit: type=1400 audit(1785612322.363:232650): lsm=SMACK fn=smack_inode_permission action=granted subject="_" object="_" requested=x pid=11448 comm="udevd" name="gadget.3" dev="sysfs" ino=31550 [ 610.021904][T12308] FAULT_INJECTION: forcing a failure. [ 610.021904][T12308] name failslab, interval 1, probability 0, space 0, times 0 [ 610.021945][T12308] CPU: 1 UID: 0 PID: 12308 Comm: syz.0.2290 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 610.021977][T12308] Tainted: [L]=SOFTLOCKUP [ 610.021986][T12308] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 610.022001][T12308] Call Trace: [ 610.022010][T12308] [ 610.022020][T12308] dump_stack_lvl+0xe8/0x150 [ 610.022063][T12308] should_fail_ex+0x467/0x600 [ 610.022108][T12308] should_failslab+0xa8/0x100 [ 610.022139][T12308] __kmalloc_noprof+0xfe/0x780 [ 610.022165][T12308] ? tomoyo_encode+0x2ad/0x570 [ 610.022194][T12308] ? tomoyo_encode+0x2ad/0x570 [ 610.022232][T12308] tomoyo_encode+0x2ad/0x570 [ 610.022270][T12308] tomoyo_realpath_from_path+0x5fa/0x640 [ 610.022313][T12308] ? tomoyo_path_number_perm+0x219/0x5f0 [ 610.022341][T12308] tomoyo_path_number_perm+0x246/0x5f0 [ 610.022372][T12308] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 610.022398][T12308] ? __lock_acquire+0x683/0x2ce0 [ 610.022440][T12308] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 610.022472][T12308] ? hook_file_ioctl+0x1f3/0x600 [ 610.022505][T12308] ? lockdep_hardirqs_on+0x7a/0x110 [ 610.022556][T12308] ? __fget_files+0x2a/0x420 [ 610.022585][T12308] ? __fget_files+0x2a/0x420 [ 610.022609][T12308] ? __fget_files+0x3a8/0x420 [ 610.022633][T12308] ? __fget_files+0x2a/0x420 [ 610.022661][T12308] security_file_ioctl+0xc3/0x2a0 [ 610.022690][T12308] __se_sys_ioctl+0x47/0x170 [ 610.022721][T12308] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 610.022746][T12308] do_syscall_64+0x174/0x580 [ 610.022777][T12308] ? trace_irq_disable+0x3b/0x140 [ 610.022801][T12308] ? clear_bhb_loop+0x40/0x90 [ 610.022831][T12308] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 610.022854][T12308] RIP: 0033:0x7ffa0d6ce019 [ 610.022882][T12308] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 610.022902][T12308] RSP: 002b:00007ffa0b926028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 610.022928][T12308] RAX: ffffffffffffffda RBX: 00007ffa0d955fa0 RCX: 00007ffa0d6ce019 [ 610.022946][T12308] RDX: 0000200000000200 RSI: 00000000c02c5625 RDI: 0000000000000003 [ 610.022961][T12308] RBP: 00007ffa0b926090 R08: 0000000000000000 R09: 0000000000000000 [ 610.022977][T12308] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 610.022989][T12308] R13: 00007ffa0d956038 R14: 00007ffa0d955fa0 R15: 00007ffd2e465b68 [ 610.023026][T12308] [ 610.024725][T12308] ERROR: Out of memory at tomoyo_realpath_from_path. [ 610.026237][T12309] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2292'. [ 610.159534][ T5715] usb 2-1: new high-speed USB device number 54 using dummy_hcd [ 610.466579][ T5715] usb 2-1: Using ep0 maxpacket: 16 [ 610.470407][ T5715] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 610.470433][ T5715] usb 2-1: config 0 has 1 interface, different from the descriptor's value: 2 [ 610.470486][ T5715] usb 2-1: New USB device found, idVendor=05d8, idProduct=810a, bcdDevice=92.b8 [ 610.470511][ T5715] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 610.612805][ T5715] usb 2-1: config 0 descriptor?? [ 610.684768][ T5715] dvb-usb: found a 'Artec T1 USB2.0' in warm state. [ 610.732695][ T5715] dvb-usb: bulk message failed: -22 (3/0) [ 610.808965][ T9] usb 4-1: new high-speed USB device number 52 using dummy_hcd [ 610.945937][T11729] netdevsim netdevsim4 netdevsim0: renamed from eth0 [ 610.979870][ T9] usb 4-1: Using ep0 maxpacket: 32 [ 610.994068][ T9] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 610.994102][ T9] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 610.994142][ T9] usb 4-1: New USB device found, idVendor=046d, idProduct=c31c, bcdDevice= 0.40 [ 610.994167][ T9] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 611.050185][ T9] usb 4-1: config 0 descriptor?? [ 611.080679][ T9] hub 4-1:0.0: USB hub found [ 611.427474][ T9] hub 4-1:0.0: 1 port detected [ 611.449579][T11729] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 611.508048][T11729] netdevsim netdevsim4 netdevsim1: renamed from eth1 [ 611.617757][ T5708] usb 3-1: new high-speed USB device number 37 using dummy_hcd [ 611.766406][ T5708] usb 3-1: Using ep0 maxpacket: 16 [ 611.795136][ T5708] usb 3-1: config index 0 descriptor too short (expected 51443, got 18) [ 611.845276][ T5708] usb 3-1: New USB device found, idVendor=17ef, idProduct=721e, bcdDevice=de.06 [ 611.845309][ T5708] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 611.845331][ T5708] usb 3-1: Product: syz [ 611.845347][ T5708] usb 3-1: Manufacturer: syz [ 611.845364][ T5708] usb 3-1: SerialNumber: syz [ 611.908110][T11729] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 611.914207][T12311] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 611.915865][T12311] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 611.942436][T11729] netdevsim netdevsim4 netdevsim2: renamed from eth2 [ 611.994521][ T5715] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 612.054857][ T5715] dvbdev: DVB: registering new adapter (Artec T1 USB2.0) [ 612.054944][ T5715] usb 2-1: media controller created [ 612.085251][ T5708] r8152-cfgselector 3-1: Unknown version 0x0000 [ 612.085278][ T5708] r8152-cfgselector 3-1: config 0 descriptor?? [ 612.340127][ T9] usb 4-1: USB disconnect, device number 52 [ 612.384278][T11729] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 612.398970][T11729] netdevsim netdevsim4 netdevsim3: renamed from eth3 [ 612.545713][ T5715] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 612.691838][ T1246] r8152-cfgselector 3-1: USB disconnect, device number 37 [ 612.776762][T11729] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 613.195522][T11729] 8021q: adding VLAN 0 to HW filter on device bond0 [ 613.493336][ T5715] dvb-usb: bulk message failed: -22 (6/0) [ 613.493473][ T5715] dvb-usb: no frontend was attached by 'Artec T1 USB2.0' [ 613.551912][ T5715] input: IR-receiver inside an USB DVB receiver as /devices/platform/dummy_hcd.1/usb2/2-1/input/input29 [ 613.640117][ T5715] dvb-usb: schedule remote query interval to 150 msecs. [ 613.640144][ T5715] dvb-usb: Artec T1 USB2.0 successfully initialized and connected. [ 613.657100][ T5715] usb 2-1: USB disconnect, device number 54 [ 613.697325][T11729] 8021q: adding VLAN 0 to HW filter on device team0 [ 613.887158][ T3336] bridge0: port 1(bridge_slave_0) entered blocking state [ 613.887271][ T3336] bridge0: port 1(bridge_slave_0) entered forwarding state [ 614.000240][ T3336] bridge0: port 2(bridge_slave_1) entered blocking state [ 614.000372][ T3336] bridge0: port 2(bridge_slave_1) entered forwarding state [ 614.128456][ T37] kauditd_printk_skb: 11780 callbacks suppressed [ 614.128484][ T37] audit: type=1400 audit(1785612327.373:242068): lsm=SMACK fn=smack_inode_permission action=granted subject="_" object="_" requested=x pid=4963 comm="udevd" name="/" dev="sda1" ino=2 [ 614.128597][ T37] audit: type=1400 audit(1785612327.373:242069): lsm=SMACK fn=smack_inode_permission action=granted subject="_" object="_" requested=x pid=4963 comm="udevd" name="/" dev="tmpfs" ino=1 [ 614.128717][ T37] audit: type=1400 audit(1785612327.373:242070): lsm=SMACK fn=smack_inode_permission action=granted subject="_" object="_" requested=x pid=4963 comm="udevd" name="udev" dev="tmpfs" ino=9 [ 614.128841][ T37] audit: type=1400 audit(1785612327.373:242071): lsm=SMACK fn=smack_inode_permission action=granted subject="_" object="_" requested=w pid=4963 comm="udevd" name="queue" dev="tmpfs" ino=7032 [ 614.130198][ T37] audit: type=1400 audit(1785612327.373:242072): lsm=SMACK fn=smack_inode_permission action=granted subject="_" object="_" requested=x pid=11473 comm="udevd" name="/" dev="sda1" ino=2 [ 614.130251][ T37] audit: type=1400 audit(1785612327.373:242073): lsm=SMACK fn=smack_file_open action=granted subject="_" object="_" requested=r pid=4963 comm="udevd" path="/run/udev/queue" dev="tmpfs" ino=7032 [ 614.140956][ T37] audit: type=1400 audit(1785612327.373:242074): lsm=SMACK fn=smack_inode_permission action=granted subject="_" object="_" requested=x pid=11473 comm="udevd" name="/" dev="devtmpfs" ino=1 [ 614.141021][ T37] audit: type=1400 audit(1785612327.373:242075): lsm=SMACK fn=smack_inode_permission action=granted subject="_" object="_" requested=r pid=11473 comm="udevd" name="loop1" dev="devtmpfs" ino=648 [ 614.141071][ T37] audit: type=1400 audit(1785612327.373:242076): lsm=SMACK fn=smack_file_open action=granted subject="_" object="_" requested=r pid=11473 comm="udevd" path="/dev/loop1" dev="devtmpfs" ino=648 [ 614.141115][ T37] audit: type=1400 audit(1785612327.333:242034): lsm=SMACK fn=smack_inode_getattr action=granted subject="_" object="_" requested=r pid=11469 comm="udevd" path="/sys/devices/platform/uevent" dev="sysfs" ino=49 [ 614.913767][T12391] net_ratelimit: 2 callbacks suppressed [ 614.913786][T12391] openvswitch: netlink: IP tunnel attribute has 8 unknown bytes. [ 614.913817][T12391] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 615.146491][ T821] usb 3-1: new high-speed USB device number 38 using dummy_hcd [ 615.199945][ T5715] dvb-usb: Artec T1 USB2.0 successfully deinitialized and disconnected. [ 615.224762][T12395] FAULT_INJECTION: forcing a failure. [ 615.224762][T12395] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 615.224801][T12395] CPU: 0 UID: 0 PID: 12395 Comm: syz.0.2314 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 615.224833][T12395] Tainted: [L]=SOFTLOCKUP [ 615.224842][T12395] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 615.224857][T12395] Call Trace: [ 615.224866][T12395] [ 615.224876][T12395] dump_stack_lvl+0xe8/0x150 [ 615.224929][T12395] should_fail_ex+0x467/0x600 [ 615.224971][T12395] _copy_from_user+0x2d/0xb0 [ 615.225002][T12395] ucma_resolve_ip+0xb8/0x490 [ 615.225032][T12395] ? __might_fault+0xaf/0x130 [ 615.225065][T12395] ? __pfx_ucma_resolve_ip+0x10/0x10 [ 615.225116][T12395] ucma_write+0x257/0x2f0 [ 615.225146][T12395] ? __pfx_ucma_write+0x10/0x10 [ 615.225172][T12395] ? security_file_permission+0x75/0x260 [ 615.225201][T12395] ? rw_verify_area+0x209/0x4d0 [ 615.225235][T12395] vfs_writev+0x4c4/0x990 [ 615.225259][T12395] ? __pfx_ucma_write+0x10/0x10 [ 615.225290][T12395] ? __pfx_vfs_writev+0x10/0x10 [ 615.225328][T12395] ? __fget_files+0x2a/0x420 [ 615.225358][T12395] ? __fget_files+0x3a8/0x420 [ 615.225381][T12395] ? __fget_files+0x2a/0x420 [ 615.225415][T12395] do_writev+0x15a/0x2e0 [ 615.225440][T12395] ? __pfx_do_writev+0x10/0x10 [ 615.225471][T12395] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 615.225497][T12395] do_syscall_64+0x174/0x580 [ 615.225529][T12395] ? trace_irq_disable+0x3b/0x140 [ 615.225552][T12395] ? clear_bhb_loop+0x40/0x90 [ 615.225581][T12395] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 615.225604][T12395] RIP: 0033:0x7ffa0d6ce019 [ 615.225625][T12395] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 615.225645][T12395] RSP: 002b:00007ffa0b926028 EFLAGS: 00000246 ORIG_RAX: 0000000000000014 [ 615.225670][T12395] RAX: ffffffffffffffda RBX: 00007ffa0d955fa0 RCX: 00007ffa0d6ce019 [ 615.225688][T12395] RDX: 0000000000000002 RSI: 0000200000000040 RDI: 0000000000000006 [ 615.225702][T12395] RBP: 00007ffa0b926090 R08: 0000000000000000 R09: 0000000000000000 [ 615.225717][T12395] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 615.225732][T12395] R13: 00007ffa0d956038 R14: 00007ffa0d955fa0 R15: 00007ffd2e465b68 [ 615.225769][T12395] [ 615.312664][ T821] usb 3-1: Using ep0 maxpacket: 16 [ 615.393450][ T821] usb 3-1: config index 0 descriptor too short (expected 51443, got 18) [ 615.500609][ T821] usb 3-1: New USB device found, idVendor=17ef, idProduct=721e, bcdDevice=de.06 [ 615.500640][ T821] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 615.500662][ T821] usb 3-1: Product: syz [ 615.500677][ T821] usb 3-1: Manufacturer: syz [ 615.500693][ T821] usb 3-1: SerialNumber: syz [ 615.580793][ T821] r8152-cfgselector 3-1: Unknown version 0x0000 [ 615.580821][ T821] r8152-cfgselector 3-1: config 0 descriptor?? [ 615.739314][T12405] netlink: 80 bytes leftover after parsing attributes in process `syz.1.2316'. [ 616.050048][ T1246] r8152-cfgselector 3-1: USB disconnect, device number 38 [ 616.463617][T12422] netlink: 12 bytes leftover after parsing attributes in process `syz.3.2321'. [ 616.551823][T12424] FAULT_INJECTION: forcing a failure. [ 616.551823][T12424] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 616.551864][T12424] CPU: 0 UID: 0 PID: 12424 Comm: syz.0.2322 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 616.551896][T12424] Tainted: [L]=SOFTLOCKUP [ 616.551905][T12424] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 616.551919][T12424] Call Trace: [ 616.551928][T12424] [ 616.551937][T12424] dump_stack_lvl+0xe8/0x150 [ 616.551976][T12424] should_fail_ex+0x467/0x600 [ 616.552017][T12424] _copy_from_iter+0x1d3/0x1660 [ 616.552045][T12424] ? rcu_is_watching+0x15/0xb0 [ 616.552075][T12424] ? trace_kmem_cache_alloc+0x29/0xe0 [ 616.552102][T12424] ? __pfx__copy_from_iter+0x10/0x10 [ 616.552124][T12424] ? __alloc_skb+0x276/0x7a0 [ 616.552148][T12424] ? __alloc_skb+0x276/0x7a0 [ 616.552178][T12424] ? netlink_sendmsg+0x650/0xb40 [ 616.552209][T12424] ? skb_put+0x112/0x210 [ 616.552238][T12424] netlink_sendmsg+0x6c0/0xb40 [ 616.552267][T12424] ? _parse_integer_limit+0x192/0x1e0 [ 616.552310][T12424] ? __pfx_netlink_sendmsg+0x10/0x10 [ 616.552342][T12424] ? tomoyo_socket_sendmsg_permission+0x1e0/0x300 [ 616.552389][T12424] ? get_pid_task+0x20/0x1f0 [ 616.552424][T12424] ? __pfx_netlink_sendmsg+0x10/0x10 [ 616.552454][T12424] sock_sendmsg_nosec+0x13a/0x180 [ 616.552492][T12424] sock_write_iter+0x2e4/0x3f0 [ 616.552527][T12424] ? __pfx_sock_write_iter+0x10/0x10 [ 616.552569][T12424] ? bpf_lsm_file_permission+0x9/0x20 [ 616.552605][T12424] ? security_file_permission+0x75/0x260 [ 616.552639][T12424] vfs_write+0x61e/0xbb0 [ 616.552676][T12424] ? __pfx_vfs_write+0x10/0x10 [ 616.552714][T12424] ? __fget_files+0x2a/0x420 [ 616.552748][T12424] ksys_write+0x156/0x270 [ 616.552780][T12424] ? __pfx_ksys_write+0x10/0x10 [ 616.552817][T12424] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 616.552842][T12424] do_syscall_64+0x174/0x580 [ 616.552873][T12424] ? trace_irq_disable+0x3b/0x140 [ 616.552896][T12424] ? clear_bhb_loop+0x40/0x90 [ 616.552923][T12424] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 616.552944][T12424] RIP: 0033:0x7ffa0d6ce019 [ 616.552964][T12424] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 616.552984][T12424] RSP: 002b:00007ffa0b926028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 616.553008][T12424] RAX: ffffffffffffffda RBX: 00007ffa0d955fa0 RCX: 00007ffa0d6ce019 [ 616.553024][T12424] RDX: 0000000000000058 RSI: 0000200000000000 RDI: 0000000000000003 [ 616.553039][T12424] RBP: 00007ffa0b926090 R08: 0000000000000000 R09: 0000000000000000 [ 616.553054][T12424] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 616.553068][T12424] R13: 00007ffa0d956038 R14: 00007ffa0d955fa0 R15: 00007ffd2e465b68 [ 616.553106][T12424] [ 617.379702][T12440] FAULT_INJECTION: forcing a failure. [ 617.379702][T12440] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 617.379743][T12440] CPU: 1 UID: 0 PID: 12440 Comm: syz.1.2326 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 617.379807][T12440] Tainted: [L]=SOFTLOCKUP [ 617.379817][T12440] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 617.379832][T12440] Call Trace: [ 617.379841][T12440] [ 617.379851][T12440] dump_stack_lvl+0xe8/0x150 [ 617.379893][T12440] should_fail_ex+0x467/0x600 [ 617.379935][T12440] _copy_to_user+0x31/0xb0 [ 617.379966][T12440] simple_read_from_buffer+0xe1/0x170 [ 617.379999][T12440] proc_fail_nth_read+0x1be/0x230 [ 617.380029][T12440] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 617.380057][T12440] ? rw_verify_area+0x250/0x4d0 [ 617.380088][T12440] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 617.380114][T12440] vfs_read+0x219/0xa90 [ 617.380152][T12440] ? __pfx_vfs_read+0x10/0x10 [ 617.380184][T12440] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 617.380215][T12440] ? lockdep_hardirqs_on+0x7a/0x110 [ 617.380248][T12440] ? _raw_spin_unlock_irqrestore+0x4c/0x80 [ 617.380273][T12440] ? mutex_lock_nested+0x152/0x1d0 [ 617.380291][T12440] ? fdget_pos+0x252/0x320 [ 617.380318][T12440] ksys_read+0x156/0x270 [ 617.380344][T12440] ? __pfx_ksys_read+0x10/0x10 [ 617.380367][T12440] ? __pfx_rtc_dev_ioctl+0x10/0x10 [ 617.380469][T12440] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 617.380490][T12440] do_syscall_64+0x174/0x580 [ 617.380515][T12440] ? trace_irq_disable+0x3b/0x140 [ 617.380535][T12440] ? clear_bhb_loop+0x40/0x90 [ 617.380558][T12440] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 617.380576][T12440] RIP: 0033:0x7fe8cb9de84e [ 617.380593][T12440] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 617.380609][T12440] RSP: 002b:00007fe8c9c54fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 617.380629][T12440] RAX: ffffffffffffffda RBX: 00007fe8c9c556c0 RCX: 00007fe8cb9de84e [ 617.380643][T12440] RDX: 000000000000000f RSI: 00007fe8c9c550a0 RDI: 0000000000000004 [ 617.380655][T12440] RBP: 00007fe8c9c55090 R08: 0000000000000000 R09: 0000000000000000 [ 617.380667][T12440] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 617.380679][T12440] R13: 00007fe8cbca6128 R14: 00007fe8cbca6090 R15: 00007fff31b3a198 [ 617.380707][T12440] [ 617.686495][ T5731] usb 3-1: new high-speed USB device number 39 using dummy_hcd [ 617.841767][ T5731] usb 3-1: New USB device found, idVendor=9710, idProduct=7730, bcdDevice=96.33 [ 617.841800][ T5731] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 617.881639][ T5731] usb 3-1: config 0 descriptor?? [ 617.897937][T12445] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2328'. [ 617.897971][T12445] netlink: 32 bytes leftover after parsing attributes in process `syz.3.2328'. [ 618.528704][T12438] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 618.537767][T12438] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 618.686759][ T5715] usb 2-1: new high-speed USB device number 55 using dummy_hcd [ 618.777572][T12438] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 618.778219][T12438] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 618.906602][ T5715] usb 2-1: Using ep0 maxpacket: 16 [ 618.917383][ T5715] usb 2-1: config index 0 descriptor too short (expected 51443, got 18) [ 618.925252][T11729] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 618.973388][ T5731] usb 3-1: Cannot set autoneg [ 618.973885][ T5731] MOSCHIP usb-ethernet driver 3-1:0.0: probe with driver MOSCHIP usb-ethernet driver failed with error -71 [ 619.018000][ T5715] usb 2-1: New USB device found, idVendor=17ef, idProduct=721e, bcdDevice=de.06 [ 619.018032][ T5715] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 619.018055][ T5715] usb 2-1: Product: syz [ 619.018072][ T5715] usb 2-1: Manufacturer: syz [ 619.018103][ T5715] usb 2-1: SerialNumber: syz [ 619.076111][ T5731] usb 3-1: USB disconnect, device number 39 [ 619.141436][ T37] kauditd_printk_skb: 15208 callbacks suppressed [ 619.141458][ T37] audit: type=1400 audit(1785612332.373:254201): lsm=SMACK fn=smack_inode_permission action=granted subject="_" object="_" requested=x pid=12471 comm="modprobe" name="/" dev="sda1" ino=2 [ 619.141506][ T37] audit: type=1400 audit(1785612332.353:254130): lsm=SMACK fn=smack_inode_permission action=granted subject="_" object="_" requested=x pid=5605 comm="syz-executor" name="376" dev="tmpfs" ino=2018 [ 619.141552][ T37] audit: type=1400 audit(1785612332.373:254202): lsm=SMACK fn=smack_inode_permission action=granted subject="_" object="_" requested=x pid=12475 comm="dhcpcd" name="/" dev="sda1" ino=2 [ 619.141597][ T37] audit: type=1400 audit(1785612332.383:254203): lsm=SMACK fn=smack_file_ioctl action=granted subject="_" object="_" requested=r pid=12453 comm="syz.1.2332" path="/dev/raw-gadget" dev="devtmpfs" ino=816 [ 619.141645][ T37] audit: type=1400 audit(1785612332.383:254204): lsm=SMACK fn=smack_inode_getattr action=granted subject="_" object="_" requested=r pid=4963 comm="udevd" path="/sys/devices/virtual/block/loop1/uevent" dev="sysfs" ino=15264 [ 619.141693][ T37] audit: type=1400 audit(1785612332.353:254170): lsm=SMACK fn=smack_inode_unlink action=granted subject="_" object="_" requested=w pid=33 comm="kdevtmpfs" name="003" dev="devtmpfs" ino=727 [ 619.141743][ T37] audit: type=1400 audit(1785612332.383:254205): lsm=SMACK fn=smack_inode_permission action=granted subject="_" object="_" requested=x pid=12475 comm="dhcpcd" name="lib" dev="sda1" ino=264 [ 619.141795][ T37] audit: type=1400 audit(1785612332.383:254206): lsm=SMACK fn=smack_inode_permission action=granted subject="_" object="_" requested=x pid=12475 comm="dhcpcd" name="dhcpcd" dev="sda1" ino=265 [ 619.142256][ T37] audit: type=1400 audit(1785612332.383:254207): lsm=SMACK fn=smack_inode_permission action=granted subject="_" object="_" requested=x pid=12475 comm="dhcpcd" name="dhcpcd-run-hooks" dev="sda1" ino=273 [ 619.142302][ T5715] r8152-cfgselector 2-1: Unknown version 0x0000 [ 619.142305][ T37] audit: type=1400 audit(1785612332.383:254208): lsm=SMACK fn=smack_file_ioctl action=granted subject="_" object="_" requested=r pid=12453 comm="syz.1.2332" path="/dev/raw-gadget" dev="devtmpfs" ino=816 [ 619.142328][ T5715] r8152-cfgselector 2-1: config 0 descriptor?? [ 619.960307][ T5731] r8152-cfgselector 2-1: USB disconnect, device number 55 [ 620.536371][ T5715] usb 3-1: new full-speed USB device number 40 using dummy_hcd [ 620.588504][T12486] tipc: Started in network mode [ 620.588653][T12486] tipc: Node identity 1000001, cluster identity 4369 [ 620.588757][T12486] tipc: Node number set to 16777217 [ 620.871419][T12486] tipc: Cannot configure node identity twice [ 620.871854][T12488] netlink: 68 bytes leftover after parsing attributes in process `syz.3.2338'. [ 621.327393][ T5715] usb 3-1: not running at top speed; connect to a high speed hub [ 621.530594][T12490] tipc: New replicast peer: 10.1.1.2 [ 621.562607][ T5715] usb 3-1: config 0 has an invalid interface number: 69 but max is 1 [ 621.562639][ T5715] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 621.562661][ T5715] usb 3-1: config 0 has 1 interface, different from the descriptor's value: 2 [ 621.562685][ T5715] usb 3-1: config 0 has no interface number 0 [ 621.562720][ T5715] usb 3-1: config 0 interface 69 has no altsetting 0 [ 621.589966][ T5715] usb 3-1: New USB device found, idVendor=0451, idProduct=8140, bcdDevice= 4.82 [ 621.590074][ T5715] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 621.590151][ T5715] usb 3-1: Product: syz [ 621.590193][ T5715] usb 3-1: Manufacturer: syz [ 621.590237][ T5715] usb 3-1: SerialNumber: syz [ 621.653249][ T5715] usb 3-1: config 0 descriptor?? [ 621.813586][T12490] tipc: Enabled bearer , priority 10 [ 621.942903][ T5715] hub 3-1:0.69: bad descriptor, ignoring hub [ 621.942943][ T5715] hub 3-1:0.69: probe with driver hub failed with error -5 [ 622.069360][ T5715] rndis_host 3-1:0.69: rndis: master #0/0000000000000000 slave #1/0000000000000000 [ 622.162906][ T5715] usb 3-1: USB disconnect, device number 40 [ 622.503696][T12508] netlink: 5 bytes leftover after parsing attributes in process `syz.0.2342'. [ 622.767458][T11729] veth0_vlan: entered promiscuous mode [ 622.860929][T11729] veth1_vlan: entered promiscuous mode [ 623.013716][T11729] veth0_macvtap: entered promiscuous mode [ 623.039035][T11729] veth1_macvtap: entered promiscuous mode [ 623.070098][T11729] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 623.132668][T11729] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 623.409421][ T12] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 623.411922][ T3425] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 623.411968][ T3425] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 623.412007][ T3425] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 623.453495][T12532] FAULT_INJECTION: forcing a failure. [ 623.453495][T12532] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 623.453602][T12532] CPU: 0 UID: 0 PID: 12532 Comm: syz.2.2349 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 623.453682][T12532] Tainted: [L]=SOFTLOCKUP [ 623.453714][T12532] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 623.453763][T12532] Call Trace: [ 623.453784][T12532] [ 623.453812][T12532] dump_stack_lvl+0xe8/0x150 [ 623.453919][T12532] should_fail_ex+0x467/0x600 [ 623.454022][T12532] _copy_from_iter+0x1d3/0x1660 [ 623.454080][T12532] ? rcu_is_watching+0x15/0xb0 [ 623.454110][T12532] ? trace_kmem_cache_alloc+0x29/0xe0 [ 623.454227][T12532] ? __pfx__copy_from_iter+0x10/0x10 [ 623.454314][T12532] ? __alloc_skb+0x276/0x7a0 [ 623.454382][T12532] ? __alloc_skb+0x276/0x7a0 [ 623.454460][T12532] ? netlink_sendmsg+0x650/0xb40 [ 623.454526][T12532] ? skb_put+0x112/0x210 [ 623.454604][T12532] netlink_sendmsg+0x6c0/0xb40 [ 623.454698][T12532] ? __pfx_netlink_sendmsg+0x10/0x10 [ 623.454781][T12532] ? tomoyo_socket_sendmsg_permission+0x1e0/0x300 [ 623.454870][T12532] ? __kernel_text_address+0xd/0x30 [ 623.454929][T12532] ? unwind_get_return_address+0x4d/0x90 [ 623.455002][T12532] ? __pfx_netlink_sendmsg+0x10/0x10 [ 623.455080][T12532] sock_sendmsg_nosec+0x13a/0x180 [ 623.455182][T12532] ____sys_sendmsg+0x565/0x870 [ 623.455247][T12532] ? __might_fault+0xaf/0x130 [ 623.455327][T12532] ? __pfx_____sys_sendmsg+0x10/0x10 [ 623.455453][T12532] ? import_iovec+0x73/0xa0 [ 623.455521][T12532] ___sys_sendmsg+0x2a5/0x360 [ 623.455564][T12532] ? __lock_acquire+0x683/0x2ce0 [ 623.455620][T12532] ? __pfx____sys_sendmsg+0x10/0x10 [ 623.455855][T12532] ? __fget_files+0x2a/0x420 [ 623.455930][T12532] ? __fget_files+0x3a8/0x420 [ 623.456018][T12532] __x64_sys_sendmsg+0x1b7/0x290 [ 623.456100][T12532] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 623.456221][T12532] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 623.456263][T12532] do_syscall_64+0x174/0x580 [ 623.456293][T12532] ? trace_irq_disable+0x3b/0x140 [ 623.456316][T12532] ? clear_bhb_loop+0x40/0x90 [ 623.456344][T12532] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 623.456400][T12532] RIP: 0033:0x7f223d68e019 [ 623.456451][T12532] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 623.456501][T12532] RSP: 002b:00007f223b8e6028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 623.456568][T12532] RAX: ffffffffffffffda RBX: 00007f223d915fa0 RCX: 00007f223d68e019 [ 623.456617][T12532] RDX: 0000000000000000 RSI: 0000200000000740 RDI: 0000000000000003 [ 623.456655][T12532] RBP: 00007f223b8e6090 R08: 0000000000000000 R09: 0000000000000000 [ 623.456688][T12532] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 623.456735][T12532] R13: 00007f223d916038 R14: 00007f223d915fa0 R15: 00007fff1f02b5a8 [ 623.456819][T12532] [ 624.152404][ T37] kauditd_printk_skb: 12740 callbacks suppressed [ 624.152424][ T37] audit: type=1400 audit(1785612337.383:262323): lsm=SMACK fn=smack_socket_sock_rcv_skb action=granted subject="_" object="_" requested=w pid=1200 comm="irq/31-virtio1-" saddr=10.128.0.169 src=30008 daddr=10.128.1.138 dest=49538 netif=eth0 [ 624.152476][ T37] audit: type=1400 audit(1785612337.383:262324): lsm=SMACK fn=smack_socket_sock_rcv_skb action=granted subject="_" object="_" requested=w pid=1200 comm="irq/31-virtio1-" saddr=10.128.0.169 src=30008 daddr=10.128.1.138 dest=49538 netif=eth0 [ 624.152523][ T37] audit: type=1400 audit(1785612337.383:262325): lsm=SMACK fn=smack_socket_sock_rcv_skb action=granted subject="_" object="_" requested=w pid=1200 comm="irq/31-virtio1-" saddr=10.128.0.169 src=30008 daddr=10.128.1.138 dest=49538 netif=eth0 [ 624.152569][ T37] audit: type=1400 audit(1785612337.383:262326): lsm=SMACK fn=smack_socket_sock_rcv_skb action=granted subject="_" object="_" requested=w pid=1200 comm="irq/31-virtio1-" saddr=10.128.0.169 src=30008 daddr=10.128.1.138 dest=49538 netif=eth0 [ 624.159549][ T37] audit: type=1400 audit(1785612337.403:262327): lsm=SMACK fn=smack_inode_permission action=granted subject="_" object="_" requested=x pid=4963 comm="udevd" name="/" dev="sysfs" ino=1 [ 624.159589][ T37] audit: type=1400 audit(1785612337.403:262328): lsm=SMACK fn=smack_inode_permission action=granted subject="_" object="_" requested=x pid=4963 comm="udevd" name="devices" dev="sysfs" ino=18 [ 624.159622][ T37] audit: type=1400 audit(1785612337.403:262329): lsm=SMACK fn=smack_inode_permission action=granted subject="_" object="_" requested=x pid=4963 comm="udevd" name="virtual" dev="sysfs" ino=1389 [ 624.159654][ T37] audit: type=1400 audit(1785612337.403:262330): lsm=SMACK fn=smack_inode_permission action=granted subject="_" object="_" requested=x pid=4963 comm="udevd" name="block" dev="sysfs" ino=13350 [ 624.159694][ T37] audit: type=1400 audit(1785612337.403:262331): lsm=SMACK fn=smack_inode_permission action=granted subject="_" object="_" requested=x pid=4963 comm="udevd" name="loop1" dev="sysfs" ino=15263 [ 624.159727][ T37] audit: type=1400 audit(1785612337.403:262332): lsm=SMACK fn=smack_inode_permission action=granted subject="_" object="_" requested=x pid=4963 comm="udevd" name="mq" dev="sysfs" ino=15359 [ 624.441169][ T1338] ieee802154 phy0 wpan0: encryption failed: -22 [ 624.441239][ T1338] ieee802154 phy1 wpan1: encryption failed: -22 [ 624.840706][ T3336] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 624.840728][ T3336] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 625.091295][ T5731] usb 3-1: new full-speed USB device number 41 using dummy_hcd [ 625.258566][ T5731] usb 3-1: not running at top speed; connect to a high speed hub [ 625.262771][ T5731] usb 3-1: config 0 has an invalid interface number: 69 but max is 1 [ 625.262798][ T5731] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 625.262820][ T5731] usb 3-1: config 0 has 1 interface, different from the descriptor's value: 2 [ 625.262860][ T5731] usb 3-1: config 0 has no interface number 0 [ 625.262915][ T5731] usb 3-1: config 0 interface 69 has no altsetting 0 [ 625.279940][ T5731] usb 3-1: New USB device found, idVendor=0451, idProduct=8140, bcdDevice= 4.82 [ 625.279972][ T5731] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 625.279994][ T5731] usb 3-1: Product: syz [ 625.280009][ T5731] usb 3-1: Manufacturer: syz [ 625.280025][ T5731] usb 3-1: SerialNumber: syz [ 625.395885][ T5731] usb 3-1: config 0 descriptor?? [ 625.678553][ T5731] hub 3-1:0.69: bad descriptor, ignoring hub [ 625.678580][ T5731] hub 3-1:0.69: probe with driver hub failed with error -5 [ 625.683642][ T5731] rndis_host 3-1:0.69: rndis: master #0/0000000000000000 slave #1/0000000000000000 [ 625.753672][ T5731] usb 3-1: USB disconnect, device number 41 [ 625.769986][ T43] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 625.770009][ T43] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 626.022815][T12561] FAULT_INJECTION: forcing a failure. [ 626.022815][T12561] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 626.022855][T12561] CPU: 0 UID: 0 PID: 12561 Comm: syz.0.2359 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 626.022886][T12561] Tainted: [L]=SOFTLOCKUP [ 626.022895][T12561] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 626.022909][T12561] Call Trace: [ 626.022917][T12561] [ 626.022927][T12561] dump_stack_lvl+0xe8/0x150 [ 626.022968][T12561] should_fail_ex+0x467/0x600 [ 626.023010][T12561] _copy_to_iter+0x1e4/0x1810 [ 626.023054][T12561] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 626.023085][T12561] ? lockdep_hardirqs_on+0x7a/0x110 [ 626.023116][T12561] ? rcu_preempt_deferred_qs_irqrestore+0x911/0xb90 [ 626.023140][T12561] ? __pfx__copy_to_iter+0x10/0x10 [ 626.023179][T12561] timerfd_read_iter+0x644/0x790 [ 626.023210][T12561] ? __pfx_timerfd_read_iter+0x10/0x10 [ 626.023230][T12561] ? __css_rstat_updated+0x235/0x540 [ 626.023324][T12561] ? io_file_get_flags+0xe9/0x160 [ 626.023354][T12561] ? bpf_lsm_file_permission+0x9/0x20 [ 626.023388][T12561] ? security_file_permission+0x75/0x260 [ 626.023415][T12561] ? rw_verify_area+0x250/0x4d0 [ 626.023445][T12561] ? __pfx_timerfd_read_iter+0x10/0x10 [ 626.023467][T12561] __io_read+0x721/0x1510 [ 626.023554][T12561] ? __pfx___io_read+0x10/0x10 [ 626.023584][T12561] ? __enqueue_entity+0x277/0xb40 [ 626.023641][T12561] io_read+0x4a/0x1e0 [ 626.023677][T12561] __io_issue_sqe+0x188/0x4d0 [ 626.023717][T12561] io_issue_sqe+0x16d/0x1020 [ 626.023756][T12561] io_req_task_submit+0xe6/0x180 [ 626.023786][T12561] io_poll_task_func+0x8d6/0xb30 [ 626.023829][T12561] ? __pfx_io_poll_task_func+0x10/0x10 [ 626.023866][T12561] ? tctx_task_work_run+0x2df/0xa80 [ 626.023888][T12561] ? __pfx_io_poll_task_func+0x10/0x10 [ 626.023923][T12561] tctx_task_work_run+0x5ac/0xa80 [ 626.023959][T12561] ? __pfx_tctx_task_work_run+0x10/0x10 [ 626.023993][T12561] tctx_task_work+0x3f/0x60 [ 626.024023][T12561] task_work_run+0x1d9/0x270 [ 626.024050][T12561] ? __pfx_task_work_run+0x10/0x10 [ 626.024072][T12561] ? _raw_spin_unlock_irqrestore+0x4c/0x80 [ 626.024112][T12561] get_signal+0x1182/0x12c0 [ 626.024146][T12561] ? fput+0xa0/0xd0 [ 626.024169][T12561] ? do_timerfd_settime+0xf2c/0x1190 [ 626.024202][T12561] arch_do_signal_or_restart+0xbb/0x860 [ 626.024238][T12561] ? __pfx_arch_do_signal_or_restart+0x10/0x10 [ 626.024268][T12561] ? __x64_sys_timerfd_settime+0x1d5/0x240 [ 626.024313][T12561] exit_to_user_mode_loop+0x104/0x730 [ 626.024336][T12561] ? rcu_is_watching+0x15/0xb0 [ 626.024365][T12561] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 626.024390][T12561] do_syscall_64+0x353/0x580 [ 626.024417][T12561] ? trace_irq_disable+0x3b/0x140 [ 626.024440][T12561] ? clear_bhb_loop+0x40/0x90 [ 626.024467][T12561] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 626.024490][T12561] RIP: 0033:0x7ffa0d6ce019 [ 626.024511][T12561] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 626.024530][T12561] RSP: 002b:00007ffa0b926028 EFLAGS: 00000246 ORIG_RAX: 000000000000011e [ 626.024554][T12561] RAX: 0000000000000000 RBX: 00007ffa0d955fa0 RCX: 00007ffa0d6ce019 [ 626.024569][T12561] RDX: 0000200000000040 RSI: 0000000000000003 RDI: 0000000000000003 [ 626.024585][T12561] RBP: 00007ffa0b926090 R08: 0000000000000000 R09: 0000000000000000 [ 626.024599][T12561] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 626.024613][T12561] R13: 00007ffa0d956038 R14: 00007ffa0d955fa0 R15: 00007ffd2e465b68 [ 626.024648][T12561] [ 628.423056][ T5614] Bluetooth: hci3: ACL packet for unknown connection handle 200 [ 628.737715][T12595] FAULT_INJECTION: forcing a failure. [ 628.737715][T12595] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 628.737756][T12595] CPU: 0 UID: 0 PID: 12595 Comm: syz.2.2372 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 628.737786][T12595] Tainted: [L]=SOFTLOCKUP [ 628.737794][T12595] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 628.737809][T12595] Call Trace: [ 628.737817][T12595] [ 628.737825][T12595] dump_stack_lvl+0xe8/0x150 [ 628.737860][T12595] should_fail_ex+0x467/0x600 [ 628.737898][T12595] _copy_from_user+0x2d/0xb0 [ 628.737931][T12595] tipc_setsockopt+0x275/0x9a0 [ 628.738055][T12595] ? __pfx_tipc_setsockopt+0x10/0x10 [ 628.738081][T12595] ? __fget_files+0x2a/0x420 [ 628.738109][T12595] ? __fget_files+0x2a/0x420 [ 628.738133][T12595] ? bpf_lsm_socket_setsockopt+0x9/0x20 [ 628.738166][T12595] ? __pfx_tipc_setsockopt+0x10/0x10 [ 628.738193][T12595] do_sock_setsockopt+0x17c/0x1b0 [ 628.738228][T12595] __x64_sys_setsockopt+0x143/0x1b0 [ 628.738270][T12595] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 628.738298][T12595] do_syscall_64+0x174/0x580 [ 628.738330][T12595] ? trace_irq_disable+0x3b/0x140 [ 628.738355][T12595] ? clear_bhb_loop+0x40/0x90 [ 628.738384][T12595] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 628.738408][T12595] RIP: 0033:0x7f223d68e019 [ 628.738429][T12595] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 628.738451][T12595] RSP: 002b:00007f223b8e6028 EFLAGS: 00000246 ORIG_RAX: 0000000000000036 [ 628.738474][T12595] RAX: ffffffffffffffda RBX: 00007f223d915fa0 RCX: 00007f223d68e019 [ 628.738492][T12595] RDX: 000000000000007f RSI: 000000000000010f RDI: 0000000000000003 [ 628.738508][T12595] RBP: 00007f223b8e6090 R08: 0000000000000004 R09: 0000000000000000 [ 628.738523][T12595] R10: 0000200000000300 R11: 0000000000000246 R12: 0000000000000001 [ 628.738538][T12595] R13: 00007f223d916038 R14: 00007f223d915fa0 R15: 00007fff1f02b5a8 [ 628.738575][T12595] [ 629.049693][ T4912] Bluetooth: hci5: unexpected cc 0x0c03 length: 249 > 1 [ 629.097993][ T4912] Bluetooth: hci5: unexpected cc 0x1003 length: 249 > 9 [ 629.100961][ T4912] Bluetooth: hci5: unexpected cc 0x1001 length: 249 > 9 [ 629.105039][ T4912] Bluetooth: hci5: unexpected cc 0x0c23 length: 249 > 4 [ 629.111335][ T4912] Bluetooth: hci5: unexpected cc 0x0c38 length: 249 > 2 [ 629.203921][ T4963] audit_log_start: 13394 callbacks suppressed [ 629.203940][ T4963] audit: audit_backlog=65 > audit_backlog_limit=64 [ 629.203956][ T4963] audit: audit_lost=20504 audit_rate_limit=0 audit_backlog_limit=64 [ 629.203972][ T4963] audit: backlog limit exceeded [ 629.204005][ T5605] audit: audit_backlog=65 > audit_backlog_limit=64 [ 629.204020][ T5605] audit: audit_lost=20505 audit_rate_limit=0 audit_backlog_limit=64 [ 629.204037][ T5605] audit: backlog limit exceeded [ 629.204059][ T5605] audit: audit_backlog=65 > audit_backlog_limit=64 [ 629.204073][ T5605] audit: audit_lost=20506 audit_rate_limit=0 audit_backlog_limit=64 [ 629.204089][ T5605] audit: backlog limit exceeded [ 629.204108][ T5605] audit: audit_backlog=65 > audit_backlog_limit=64 [ 629.544541][T12603] FAULT_INJECTION: forcing a failure. [ 629.544541][T12603] name failslab, interval 1, probability 0, space 0, times 0 [ 629.544582][T12603] CPU: 0 UID: 0 PID: 12603 Comm: syz.1.2375 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 629.544614][T12603] Tainted: [L]=SOFTLOCKUP [ 629.544622][T12603] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 629.544637][T12603] Call Trace: [ 629.544646][T12603] [ 629.544655][T12603] dump_stack_lvl+0xe8/0x150 [ 629.544700][T12603] should_fail_ex+0x467/0x600 [ 629.544743][T12603] should_failslab+0xa8/0x100 [ 629.544772][T12603] kmem_cache_alloc_noprof+0xa4/0x650 [ 629.544796][T12603] ? anon_vma_clone+0x3e7/0x9e0 [ 629.544819][T12603] ? anon_vma_clone+0x3e7/0x9e0 [ 629.544849][T12603] anon_vma_clone+0x3e7/0x9e0 [ 629.544883][T12603] __split_vma+0x3a5/0xa40 [ 629.544921][T12603] ? mas_next_slot+0xc94/0xd70 [ 629.545065][T12603] ? __pfx___split_vma+0x10/0x10 [ 629.545109][T12603] ? mas_find+0xab1/0xcf0 [ 629.545147][T12603] vms_gather_munmap_vmas+0x4e3/0x1370 [ 629.545196][T12603] ? __pfx_vms_gather_munmap_vmas+0x10/0x10 [ 629.545241][T12603] ? __lock_acquire+0x683/0x2ce0 [ 629.545277][T12603] do_vmi_align_munmap+0x2c7/0x4d0 [ 629.545328][T12603] ? __pfx_do_vmi_align_munmap+0x10/0x10 [ 629.545375][T12603] ? mtree_range_walk+0x70a/0x8c0 [ 629.545435][T12603] do_vmi_munmap+0x252/0x2d0 [ 629.545472][T12603] do_munmap+0xf5/0x160 [ 629.545500][T12603] ? __pfx_do_munmap+0x10/0x10 [ 629.545546][T12603] mremap_to+0x33a/0x8c0 [ 629.545580][T12603] ? mtree_load+0x12a/0x780 [ 629.545611][T12603] ? __pfx_mremap_to+0x10/0x10 [ 629.545642][T12603] ? may_expand_vm+0x24d/0x390 [ 629.545672][T12603] ? check_prep_vma+0x9ae/0xc10 [ 629.545718][T12603] __se_sys_mremap+0xe77/0x11d0 [ 629.545762][T12603] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 629.545793][T12603] ? lockdep_hardirqs_on+0x7a/0x110 [ 629.545834][T12603] ? __pfx___se_sys_mremap+0x10/0x10 [ 629.545874][T12603] ? fput+0xa0/0xd0 [ 629.545898][T12603] ? ksys_write+0x248/0x270 [ 629.545931][T12603] ? __pfx_ksys_write+0x10/0x10 [ 629.545967][T12603] ? __x64_sys_mremap+0x20/0xc0 [ 629.545998][T12603] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 629.546024][T12603] do_syscall_64+0x174/0x580 [ 629.546055][T12603] ? trace_irq_disable+0x3b/0x140 [ 629.546079][T12603] ? clear_bhb_loop+0x40/0x90 [ 629.546109][T12603] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 629.546132][T12603] RIP: 0033:0x7fe8cba1e019 [ 629.546153][T12603] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 629.546174][T12603] RSP: 002b:00007fe8c9c76028 EFLAGS: 00000246 ORIG_RAX: 0000000000000019 [ 629.546199][T12603] RAX: ffffffffffffffda RBX: 00007fe8cbca5fa0 RCX: 00007fe8cba1e019 [ 629.546225][T12603] RDX: 0000000000003000 RSI: 0000000000001000 RDI: 0000200000a56000 [ 629.546241][T12603] RBP: 00007fe8c9c76090 R08: 0000200000a51000 R09: 0000000000000000 [ 629.546257][T12603] R10: 0000000000000003 R11: 0000000000000246 R12: 0000000000000001 [ 629.546271][T12603] R13: 00007fe8cbca6038 R14: 00007fe8cbca5fa0 R15: 00007fff31b3a198 [ 629.546308][T12603] [ 631.240586][ T4912] Bluetooth: hci5: command tx timeout [ 631.385580][ T5708] usb 4-1: new full-speed USB device number 53 using dummy_hcd [ 631.539516][ T5708] usb 4-1: too many configurations: 255, using maximum allowed: 8 [ 631.541793][ T5708] usb 4-1: config 0 interface 0 altsetting 88 endpoint 0x81 has invalid wMaxPacketSize 0 [ 631.541824][ T5708] usb 4-1: config 0 interface 0 has no altsetting 0 [ 631.573079][ T5708] usb 4-1: config 0 interface 0 altsetting 88 endpoint 0x81 has invalid wMaxPacketSize 0 [ 631.573112][ T5708] usb 4-1: config 0 interface 0 has no altsetting 0 [ 631.584258][ T5708] usb 4-1: config 0 interface 0 altsetting 88 endpoint 0x81 has invalid wMaxPacketSize 0 [ 631.584291][ T5708] usb 4-1: config 0 interface 0 has no altsetting 0 [ 631.597376][ T5708] usb 4-1: config 0 interface 0 altsetting 88 endpoint 0x81 has invalid wMaxPacketSize 0 [ 631.597408][ T5708] usb 4-1: config 0 interface 0 has no altsetting 0 [ 631.614854][ T5708] usb 4-1: config 0 interface 0 altsetting 88 endpoint 0x81 has invalid wMaxPacketSize 0 [ 631.614887][ T5708] usb 4-1: config 0 interface 0 has no altsetting 0 [ 631.621318][ T5708] usb 4-1: config 0 interface 0 altsetting 88 endpoint 0x81 has invalid wMaxPacketSize 0 [ 631.621346][ T5708] usb 4-1: config 0 interface 0 has no altsetting 0 [ 631.653138][ T5708] usb 4-1: config 0 interface 0 altsetting 88 endpoint 0x81 has invalid wMaxPacketSize 0 [ 631.653171][ T5708] usb 4-1: config 0 interface 0 has no altsetting 0 [ 631.723627][ T5708] usb 4-1: config 0 interface 0 altsetting 88 endpoint 0x81 has invalid wMaxPacketSize 0 [ 631.723657][ T5708] usb 4-1: config 0 interface 0 has no altsetting 0 [ 631.755145][ T5708] usb 4-1: New USB device found, idVendor=046d, idProduct=c287, bcdDevice= 0.00 [ 631.755179][ T5708] usb 4-1: New USB device strings: Mfr=252, Product=255, SerialNumber=255 [ 631.755203][ T5708] usb 4-1: Product: syz [ 631.755219][ T5708] usb 4-1: Manufacturer: syz [ 631.755236][ T5708] usb 4-1: SerialNumber: syz [ 631.824409][ T5708] usb 4-1: config 0 descriptor?? [ 632.110247][T12657] FAULT_INJECTION: forcing a failure. [ 632.110247][T12657] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 632.110284][T12657] CPU: 1 UID: 0 PID: 12657 Comm: syz.1.2386 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 632.110309][T12657] Tainted: [L]=SOFTLOCKUP [ 632.110316][T12657] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 632.110326][T12657] Call Trace: [ 632.110333][T12657] [ 632.110340][T12657] dump_stack_lvl+0xe8/0x150 [ 632.110373][T12657] should_fail_ex+0x467/0x600 [ 632.110406][T12657] _copy_from_user+0x2d/0xb0 [ 632.110430][T12657] get_timespec64+0x96/0x1b0 [ 632.110452][T12657] ? __pfx_get_timespec64+0x10/0x10 [ 632.110470][T12657] ? kmem_cache_free+0x187/0x6c0 [ 632.110510][T12657] ? do_sys_openat2+0x14e/0x200 [ 632.110533][T12657] __se_sys_pselect6+0x13a/0x320 [ 632.110567][T12657] ? __pfx___se_sys_pselect6+0x10/0x10 [ 632.110594][T12657] ? __pfx_ksys_write+0x10/0x10 [ 632.110623][T12657] ? __x64_sys_pselect6+0x21/0xf0 [ 632.110649][T12657] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 632.110670][T12657] do_syscall_64+0x174/0x580 [ 632.110696][T12657] ? trace_irq_disable+0x3b/0x140 [ 632.110716][T12657] ? clear_bhb_loop+0x40/0x90 [ 632.110740][T12657] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 632.110757][T12657] RIP: 0033:0x7fe8cba1e019 [ 632.110774][T12657] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 632.110789][T12657] RSP: 002b:00007fe8c9c76028 EFLAGS: 00000246 ORIG_RAX: 000000000000010e [ 632.110808][T12657] RAX: ffffffffffffffda RBX: 00007fe8cbca5fa0 RCX: 00007fe8cba1e019 [ 632.110821][T12657] RDX: 0000000000000000 RSI: 0000200000000100 RDI: 0000000000000040 [ 632.110832][T12657] RBP: 00007fe8c9c76090 R08: 0000200000000280 R09: 0000000000000000 [ 632.110844][T12657] R10: 0000200000000240 R11: 0000000000000246 R12: 0000000000000001 [ 632.110854][T12657] R13: 00007fe8cbca6038 R14: 00007fe8cbca5fa0 R15: 00007fff31b3a198 [ 632.110881][T12657] [ 633.316898][ T4912] Bluetooth: hci5: command tx timeout [ 633.509002][ T5708] usbhid 4-1:0.0: couldn't find an input interrupt endpoint [ 633.530838][ T5708] usb 4-1: USB disconnect, device number 53 [ 633.614275][T12642] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 634.190377][ T4912] Bluetooth: hci4: Malformed Event: 0x2f [ 634.218187][ T37] kauditd_printk_skb: 15880 callbacks suppressed [ 634.218237][ T37] audit: type=1400 audit(1785612347.383:279265): lsm=SMACK fn=smack_inode_permission action=granted subject="_" object="_" requested=x pid=11448 comm="udevd" name="data" dev="tmpfs" ino=14 [ 634.220093][ T37] audit: type=1400 audit(1785612347.383:279266): lsm=SMACK fn=smack_inode_permission action=granted subject="_" object="_" requested=r pid=12686 comm="modprobe" name="libpam.so.0.85.1" dev="sda1" ino=1122 [ 634.224758][ T37] audit: type=1400 audit(1785612347.463:279267): lsm=SMACK fn=smack_inode_permission action=granted subject="_" object="_" requested=x pid=12383 comm="udevd" name="/" dev="sda1" ino=2 [ 634.235746][ T37] audit: type=1400 audit(1785612347.473:279269): lsm=SMACK fn=smack_socket_sock_rcv_skb action=granted subject="_" object="_" requested=w pid=1200 comm="irq/31-virtio1-" saddr=10.128.0.169 src=30008 daddr=10.128.1.138 dest=49538 netif=eth0 [ 634.498701][ T37] audit: type=1400 audit(1785612347.463:279268): lsm=SMACK fn=smack_inode_permission action=granted subject="_" object="_" requested=x pid=11846 comm="udevd" name="udev" dev="tmpfs" ino=9 [ 634.499028][ T37] audit: type=1400 audit(1785612347.493:279271): lsm=SMACK fn=smack_inode_permission action=granted subject="_" object="_" requested=x pid=12383 comm="udevd" name="/" dev="sysfs" ino=1 [ 634.499100][ T37] audit: type=1400 audit(1785612347.493:279272): lsm=SMACK fn=smack_inode_permission action=granted subject="_" object="_" requested=x pid=12383 comm="udevd" name="devices" dev="sysfs" ino=18 [ 634.499435][ T37] audit: type=1400 audit(1785612347.493:279270): lsm=SMACK fn=smack_file_open action=granted subject="_" object="_" requested=r pid=12686 comm="modprobe" path="/lib/libpam.so.0.85.1" dev="sda1" ino=1122 [ 634.499983][ T37] audit: type=1400 audit(1785612347.663:279274): lsm=SMACK fn=smack_inode_permission action=granted subject="_" object="_" requested=x pid=12383 comm="udevd" name="virtual" dev="sysfs" ino=1389 [ 634.777924][ T37] audit: type=1400 audit(1785612347.653:279273): lsm=SMACK fn=smack_inode_getattr action=granted subject="_" object="_" requested=r pid=11846 comm="udevd" path="/run/udev/watch" dev="tmpfs" ino=169 [ 635.408390][ T4912] Bluetooth: hci5: command tx timeout [ 635.655888][T12642] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 637.476404][ T4912] Bluetooth: hci5: command tx timeout [ 637.824600][T12736] TCP: request_sock_TCPv6: Possible SYN flooding on port [::]:20002. Sending cookies. [ 637.838284][ T5708] usb 3-1: new high-speed USB device number 42 using dummy_hcd [ 637.979497][T12642] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 637.996733][ T5708] usb 3-1: Using ep0 maxpacket: 8 [ 637.999158][ T5708] usb 3-1: config 0 has an invalid interface number: 55 but max is 0 [ 637.999185][ T5708] usb 3-1: config 0 has no interface number 0 [ 637.999244][ T5708] usb 3-1: config 0 interface 55 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 637.999269][ T5708] usb 3-1: config 0 interface 55 altsetting 0 has an endpoint descriptor with address 0xAB, changing to 0x8B [ 637.999297][ T5708] usb 3-1: config 0 interface 55 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 7 [ 637.999324][ T5708] usb 3-1: config 0 interface 55 altsetting 0 endpoint 0x8B has invalid wMaxPacketSize 0 [ 637.999348][ T5708] usb 3-1: config 0 interface 55 altsetting 0 has 3 endpoint descriptors, different from the interface descriptor's value: 2 [ 637.999398][ T5708] usb 3-1: New USB device found, idVendor=0f11, idProduct=1080, bcdDevice=fc.6a [ 637.999424][ T5708] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 638.119387][ T5708] usb 3-1: config 0 descriptor?? [ 638.269767][ T5708] ldusb 3-1:0.55: LD USB Device #0 now attached to major 180 minor 0 [ 638.416062][T12745] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 638.422416][T12745] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 638.498650][T12745] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 638.499077][T12745] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 638.574968][ T5718] usb 3-1: USB disconnect, device number 42 [ 638.664295][ T5718] ldusb 3-1:0.55: LD USB Device #0 now disconnected [ 639.226625][ T37] kauditd_printk_skb: 11025 callbacks suppressed [ 639.226641][ T37] audit: type=1400 audit(1785612352.463:288804): lsm=SMACK fn=smack_inode_permission action=granted subject="_" object="_" requested=x pid=12383 comm="udevd" name="data" dev="tmpfs" ino=14 [ 639.226677][ T37] audit: type=1400 audit(1785612352.463:288805): lsm=SMACK fn=smack_inode_permission action=granted subject="_" object="_" requested=wx pid=12383 comm="udevd" name="data" dev="tmpfs" ino=14 [ 639.227070][ T37] audit: type=1400 audit(1785612352.473:288806): lsm=SMACK fn=smack_inode_permission action=granted subject="_" object="_" requested=wx pid=5601 comm="syz-executor" name="373" dev="tmpfs" ino=2009 [ 639.228774][ T37] audit: type=1400 audit(1785612352.473:288807): lsm=SMACK fn=smack_inode_unlink action=granted subject="_" object="_" requested=w pid=5601 comm="syz-executor" name="cgroup.cpu" dev="tmpfs" ino=2011 [ 639.228848][ T37] audit: type=1400 audit(1785612352.473:288808): lsm=SMACK fn=smack_inode_unlink action=granted subject="_" object="_" requested=w pid=5601 comm="syz-executor" name="373" dev="tmpfs" ino=2009 [ 639.228893][ T37] audit: type=1400 audit(1785612352.473:288809): lsm=SMACK fn=smack_inode_permission action=granted subject="_" object="_" requested=x pid=5601 comm="syz-executor" name="newroot" dev="tmpfs" ino=2 [ 639.228935][ T37] audit: type=1400 audit(1785612352.473:288810): lsm=SMACK fn=smack_inode_permission action=granted subject="_" object="_" requested=x pid=5601 comm="syz-executor" name="newroot" dev="tmpfs" ino=2 [ 639.228979][ T37] audit: type=1400 audit(1785612352.473:288811): lsm=SMACK fn=smack_inode_permission action=granted subject="_" object="_" requested=x pid=5601 comm="syz-executor" name="373" dev="tmpfs" ino=2009 [ 639.229022][ T37] audit: type=1400 audit(1785612352.473:288812): lsm=SMACK fn=smack_inode_permission action=granted subject="_" object="_" requested=x pid=5601 comm="syz-executor" name="newroot" dev="tmpfs" ino=2 [ 639.229064][ T37] audit: type=1400 audit(1785612352.473:288813): lsm=SMACK fn=smack_inode_permission action=granted subject="_" object="_" requested=x pid=5601 comm="syz-executor" name="newroot" dev="tmpfs" ino=2 [ 639.706071][T12642] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 642.806647][ T10] usb 5-1: new high-speed USB device number 24 using dummy_hcd [ 642.966592][ T10] usb 5-1: Using ep0 maxpacket: 8 [ 642.975475][ T10] usb 5-1: config 0 has no interfaces? [ 642.975509][ T10] usb 5-1: New USB device found, idVendor=ee8d, idProduct=db1e, bcdDevice=61.23 [ 642.975534][ T10] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 643.016431][ T10] usb 5-1: config 0 descriptor?? [ 643.214312][T12642] bridge_slave_1: left allmulticast mode [ 643.214347][T12642] bridge_slave_1: left promiscuous mode [ 643.215735][T12642] bridge0: port 2(bridge_slave_1) entered disabled state [ 643.258845][ T5731] usb 5-1: USB disconnect, device number 24 [ 643.371314][T12642] bridge_slave_0: left allmulticast mode [ 643.371345][T12642] bridge_slave_0: left promiscuous mode [ 643.390469][T12642] bridge0: port 1(bridge_slave_0) entered disabled state [ 643.594864][T12642] pim6reg: left allmulticast mode [ 644.243021][ T37] kauditd_printk_skb: 11597 callbacks suppressed [ 644.243122][ T37] audit: type=1400 audit(1785612357.423:299283): lsm=SMACK fn=smack_inode_getattr action=granted subject="_" object="_" requested=r pid=11448 comm="udevd" path="/run/udev/data/c189:535" dev="tmpfs" ino=7264 [ 644.342020][ T37] audit: type=1400 audit(1785612357.363:299275): lsm=SMACK fn=smack_inode_permission action=granted subject="_" object="_" requested=wx pid=11469 comm="udevd" name="data" dev="tmpfs" ino=14 [ 644.342078][ T37] audit: type=1400 audit(1785612357.463:299284): lsm=SMACK fn=smack_inode_permission action=granted subject="_" object="_" requested=x pid=12822 comm="syz.2.2440" name="newroot" dev="tmpfs" ino=2 [ 644.342132][ T37] audit: type=1400 audit(1785612357.483:299285): lsm=SMACK fn=smack_inode_permission action=granted subject="_" object="_" requested=x pid=11448 comm="udevd" name="/" dev="sda1" ino=2 [ 644.342172][ T37] audit: type=1400 audit(1785612357.543:299286): lsm=SMACK fn=smack_inode_permission action=granted subject="_" object="_" requested=x pid=11448 comm="udevd" name="/" dev="tmpfs" ino=1 [ 644.342210][ T37] audit: type=1400 audit(1785612357.543:299287): lsm=SMACK fn=smack_inode_permission action=granted subject="_" object="_" requested=x pid=11448 comm="udevd" name="udev" dev="tmpfs" ino=9 [ 644.343156][ T37] audit: type=1400 audit(1785612357.543:299288): lsm=SMACK fn=smack_inode_permission action=granted subject="_" object="_" requested=x pid=11448 comm="udevd" name="data" dev="tmpfs" ino=14 [ 644.345120][ T37] audit: type=1400 audit(1785612357.553:299289): lsm=SMACK fn=smack_inode_permission action=granted subject="_" object="_" requested=x pid=12822 comm="syz.2.2440" name="/" dev="devtmpfs" ino=1 [ 644.611572][ T37] audit: type=1400 audit(1785612357.593:299290): lsm=SMACK fn=smack_inode_permission action=granted subject="_" object="_" requested=rw pid=12822 comm="syz.2.2440" name="raw-gadget" dev="devtmpfs" ino=816 [ 644.611622][ T37] audit: type=1400 audit(1785612357.603:299291): lsm=SMACK fn=smack_file_open action=granted subject="_" object="_" requested=r pid=12822 comm="syz.2.2440" path="/dev/raw-gadget" dev="devtmpfs" ino=816 [ 645.186386][ T5923] usb 3-1: new full-speed USB device number 43 using dummy_hcd [ 645.371186][ T5923] usb 3-1: not running at top speed; connect to a high speed hub [ 645.404459][ T5923] usb 3-1: config 0 has an invalid interface number: 69 but max is 1 [ 645.404480][ T5923] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 645.404494][ T5923] usb 3-1: config 0 has 1 interface, different from the descriptor's value: 2 [ 645.404509][ T5923] usb 3-1: config 0 has no interface number 0 [ 645.404532][ T5923] usb 3-1: config 0 interface 69 has no altsetting 0 [ 645.505369][ T5923] usb 3-1: New USB device found, idVendor=0451, idProduct=8140, bcdDevice= 4.82 [ 645.505390][ T5923] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 645.505404][ T5923] usb 3-1: Product: syz [ 645.505416][ T5923] usb 3-1: Manufacturer: syz [ 645.505426][ T5923] usb 3-1: SerialNumber: syz [ 645.597290][T12828] netlink: 12 bytes leftover after parsing attributes in process `syz.4.2441'. [ 645.981151][ T5923] usb 3-1: config 0 descriptor?? [ 647.598573][ T5708] usb 5-1: new high-speed USB device number 25 using dummy_hcd [ 647.604998][ T5923] hub 3-1:0.69: bad descriptor, ignoring hub [ 647.605038][ T5923] hub 3-1:0.69: probe with driver hub failed with error -5 [ 647.620026][ T5923] rndis_host 3-1:0.69: rndis: master #0/0000000000000000 slave #1/0000000000000000 [ 647.670833][ T5923] usb 3-1: USB disconnect, device number 43 [ 647.698556][T11448] udevd[11448]: setting owner of /dev/bus/usb/003/043 to uid=0, gid=0 failed: No such file or directory [ 647.763428][ T5708] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 647.763481][ T5708] usb 5-1: New USB device found, idVendor=0926, idProduct=3333, bcdDevice= 0.40 [ 647.763508][ T5708] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 647.804307][ T5708] usb 5-1: config 0 descriptor?? [ 647.967271][T12642] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 648.021189][T12642] bond0 (unregistering): Released all slaves [ 648.026059][ T5708] usbhid 5-1:0.0: can't add hid device: -71 [ 648.026163][ T5708] usbhid 5-1:0.0: probe with driver usbhid failed with error -71 [ 648.079648][ T5708] usb 5-1: USB disconnect, device number 25 [ 649.446674][ T37] kauditd_printk_skb: 3487 callbacks suppressed [ 649.446693][ T37] audit: type=1400 audit(1785612361.543:302536): lsm=SMACK fn=smack_task_setscheduler action=granted subject="_" object="_" requested=w pid=12831 comm="syz.2.2443" opid=12831 ocomm="syz.2.2443" [ 649.446741][ T37] audit: type=1400 audit(1785612361.543:302537): lsm=SMACK fn=smack_socket_sock_rcv_skb action=granted subject="_" object="_" requested=w pid=1200 comm="irq/31-virtio1-" saddr=10.128.0.169 src=30008 daddr=10.128.1.138 dest=49538 netif=eth0 [ 649.446787][ T37] audit: type=1400 audit(1785612361.723:302538): lsm=SMACK fn=smack_inode_permission action=granted subject="_" object="_" requested=x pid=12835 comm="syz.2.2443" name="395" dev="tmpfs" ino=2116 [ 649.446830][ T37] audit: type=1400 audit(1785612361.723:302539): lsm=SMACK fn=smack_inode_permission action=granted subject="_" object="_" requested=x pid=12835 comm="syz.2.2443" name="395" dev="tmpfs" ino=2116 [ 649.446875][ T37] audit: type=1400 audit(1785612361.723:302540): lsm=SMACK fn=smack_inode_permission action=granted subject="_" object="_" requested=wx pid=12835 comm="syz.2.2443" name="395" dev="tmpfs" ino=2116 [ 649.446918][ T37] audit: type=1400 audit(1785612361.723:302541): lsm=SMACK fn=smack_file_open action=granted subject="_" object="_" requested=r pid=12835 comm="syz.2.2443" path="/395/core" dev="tmpfs" ino=2121 [ 649.446961][ T37] audit: type=1400 audit(1785612361.723:302542): lsm=SMACK fn=smack_inode_setattr action=granted subject="_" object="_" requested=w pid=12835 comm="syz.2.2443" name="core" dev="tmpfs" ino=2121 [ 649.447004][ T37] audit: type=1400 audit(1785612362.223:302543): lsm=SMACK fn=smack_ptrace_access_check action=granted subject="_" object="_" requested=r pid=12831 comm="syz.2.2443" opid=12831 ocomm="syz.2.2443" [ 649.447049][ T37] audit: type=1400 audit(1785612362.223:302544): lsm=SMACK fn=smack_ptrace_access_check action=granted subject="_" object="_" requested=r pid=12831 comm="syz.2.2443" opid=12831 ocomm="syz.2.2443" [ 649.447095][ T37] audit: type=1400 audit(1785612362.323:302545): lsm=SMACK fn=smack_inode_permission action=granted subject="_" object="_" requested=x pid=12831 comm="syz.2.2443" name="newroot" dev="tmpfs" ino=2 [ 650.237546][ T5708] usb 5-1: new high-speed USB device number 26 using dummy_hcd [ 650.268961][T12592] bridge0: port 1(bridge_slave_0) entered blocking state [ 650.269142][T12592] bridge0: port 1(bridge_slave_0) entered disabled state [ 650.269296][T12592] bridge_slave_0: entered allmulticast mode [ 650.273927][T12592] bridge_slave_0: entered promiscuous mode [ 650.315028][T12592] bridge0: port 2(bridge_slave_1) entered blocking state [ 650.315252][T12592] bridge0: port 2(bridge_slave_1) entered disabled state [ 650.315474][T12592] bridge_slave_1: entered allmulticast mode [ 650.344002][T12592] bridge_slave_1: entered promiscuous mode [ 650.563887][ T5708] usb 5-1: device descriptor read/all, error -71 [ 651.049279][T12848] FAULT_INJECTION: forcing a failure. [ 651.049279][T12848] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 651.049319][T12848] CPU: 0 UID: 0 PID: 12848 Comm: syz.1.2448 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 651.049349][T12848] Tainted: [L]=SOFTLOCKUP [ 651.049357][T12848] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 651.049371][T12848] Call Trace: [ 651.049379][T12848] [ 651.049389][T12848] dump_stack_lvl+0xe8/0x150 [ 651.049431][T12848] should_fail_ex+0x467/0x600 [ 651.049472][T12848] _copy_to_user+0x31/0xb0 [ 651.049502][T12848] simple_read_from_buffer+0xe1/0x170 [ 651.049534][T12848] proc_fail_nth_read+0x1be/0x230 [ 651.049563][T12848] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 651.049598][T12848] ? rw_verify_area+0x250/0x4d0 [ 651.049628][T12848] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 651.049652][T12848] vfs_read+0x219/0xa90 [ 651.049687][T12848] ? __pfx_vfs_read+0x10/0x10 [ 651.049718][T12848] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 651.049751][T12848] ? lockdep_hardirqs_on+0x7a/0x110 [ 651.049779][T12848] ? _raw_spin_unlock_irqrestore+0x4c/0x80 [ 651.049807][T12848] ? mutex_lock_nested+0x152/0x1d0 [ 651.049837][T12848] ? fdget_pos+0x252/0x320 [ 651.049871][T12848] ksys_read+0x156/0x270 [ 651.049902][T12848] ? __pfx_ksys_read+0x10/0x10 [ 651.049940][T12848] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 651.049968][T12848] do_syscall_64+0x174/0x580 [ 651.050018][T12848] ? trace_irq_disable+0x3b/0x140 [ 651.050042][T12848] ? clear_bhb_loop+0x40/0x90 [ 651.050071][T12848] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 651.050094][T12848] RIP: 0033:0x7fe8cb9de84e [ 651.050115][T12848] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 651.050134][T12848] RSP: 002b:00007fe8c9c75fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 651.050159][T12848] RAX: ffffffffffffffda RBX: 00007fe8c9c766c0 RCX: 00007fe8cb9de84e [ 651.050187][T12848] RDX: 000000000000000f RSI: 00007fe8c9c760a0 RDI: 0000000000000006 [ 651.050202][T12848] RBP: 00007fe8c9c76090 R08: 0000000000000000 R09: 0000000000000000 [ 651.050217][T12848] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 651.050231][T12848] R13: 00007fe8cbca6038 R14: 00007fe8cbca5fa0 R15: 00007fff31b3a198 [ 651.050267][T12848] [ 651.673280][T12592] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 651.782024][T12592] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 652.660184][T12858] bond1: option tlb_dynamic_lb: invalid value (64) [ 652.805103][T12858] bond1 (unregistering): Released all slaves [ 652.966947][ T5732] usb 4-1: new high-speed USB device number 54 using dummy_hcd [ 653.004479][T12642] batman_adv: batadv0: Interface deactivated: wlan0 [ 653.120859][ T5732] usb 4-1: config 27 interface 0 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 7 [ 653.120899][ T5732] usb 4-1: config 27 interface 0 altsetting 0 bulk endpoint 0xB has invalid maxpacket 47 [ 653.120942][ T5732] usb 4-1: New USB device found, idVendor=0582, idProduct=0014, bcdDevice=bb.9d [ 653.120967][ T5732] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 653.225903][T12870] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22 [ 653.250520][ T5732] usb 4-1: Quirk or no altset; falling back to MIDI 1.0 [ 653.457717][T12642] batman_adv: batadv0: Removing interface: wlan0 [ 654.163114][ T5731] usb 4-1: USB disconnect, device number 54 [ 654.233569][T12592] team0: Port device team_slave_0 added [ 654.254780][T12592] team0: Port device team_slave_1 added [ 654.462643][ T37] kauditd_printk_skb: 12203 callbacks suppressed [ 654.462664][ T37] audit: type=1400 audit(1785612367.693:312001): lsm=SMACK fn=smack_inode_permission action=granted subject="_" object="_" requested=r pid=12900 comm="cmp" name="libc.so.6" dev="sda1" ino=1112 [ 654.462711][ T37] audit: type=1400 audit(1785612367.693:312002): lsm=SMACK fn=smack_inode_permission action=granted subject="_" object="_" requested=x pid=11473 comm="udevd" name="4-1" dev="sysfs" ino=156557 [ 654.462910][T11448] audit: audit_backlog=65 > audit_backlog_limit=64 [ 654.462927][T11448] audit: audit_lost=24607 audit_rate_limit=0 audit_backlog_limit=64 [ 654.462942][T11448] audit: backlog limit exceeded [ 654.462970][T11448] audit: audit_backlog=65 > audit_backlog_limit=64 [ 654.462985][T11448] audit: audit_lost=24608 audit_rate_limit=0 audit_backlog_limit=64 [ 654.463001][T11448] audit: backlog limit exceeded [ 654.463006][T11445] audit: audit_backlog=65 > audit_backlog_limit=64 [ 654.463022][T11445] audit: audit_lost=24609 audit_rate_limit=0 audit_backlog_limit=64 [ 654.645198][T12869] ------------[ cut here ]------------ [ 654.645213][T12869] kcov->t != t [ 654.645230][T12869] WARNING: kernel/kcov.c:475 at kcov_task_exit+0x181/0x240, CPU#1: syz.3.2454/12869 [ 654.645300][T12869] Modules linked in: [ 654.645322][T12869] CPU: 1 UID: 0 PID: 12869 Comm: syz.3.2454 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 654.645369][T12869] Tainted: [L]=SOFTLOCKUP [ 654.645377][T12869] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 654.645392][T12869] RIP: 0010:kcov_task_exit+0x181/0x240 [ 654.645430][T12869] Code: 90 00 00 00 e8 e0 d2 57 00 4c 89 f7 5b 41 5e 41 5f e9 c3 92 5d 00 7c 40 5b 41 5e 41 5f e9 97 5b 82 09 cc 90 0f 0b 90 eb 10 90 <0f> 0b 90 eb 0a 90 0f 0b 90 eb 04 90 0f 0b 90 4c 89 ff 5b 41 5e 41 [ 654.645451][T12869] RSP: 0018:ffffc90003c37d20 EFLAGS: 00010287 [ 654.645471][T12869] RAX: c5c8489df35a3d00 RBX: ffff88802d6c5d00 RCX: 0000000000000000 [ 654.645498][T12869] RDX: 00000000e8f3d702 RSI: ffffffff8bca7860 RDI: 00000000ffffffff [ 654.645514][T12869] RBP: ffffc90003c37e80 R08: ffffffff8b46cb20 R09: 0000000000000000 [ 654.645532][T12869] R10: 0000000000000000 R11: ffffffff8e1c3000 R12: 0000000000000000 [ 654.645547][T12869] R13: ffff88802d6c5d00 R14: ffff88801e289000 R15: ffff88801e289008 [ 654.645567][T12869] FS: 0000555580aa8500(0000) GS:ffff888125d3e000(0000) knlGS:0000000000000000 [ 654.645587][T12869] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 654.645603][T12869] CR2: 00007f2c37b27eb8 CR3: 000000003acd6000 CR4: 00000000003526f0 [ 654.645624][T12869] Call Trace: [ 654.645634][T12869] [ 654.645646][T12869] do_exit+0x159/0x2360 [ 654.645669][T12869] ? _raw_spin_unlock_irqrestore+0x4c/0x80 [ 654.645703][T12869] ? rt_mutex_slowunlock+0x4ee/0xa20 [ 654.645732][T12869] ? reacquire_held_locks+0x104/0x190 [ 654.645764][T12869] ? __pfx_do_exit+0x10/0x10 [ 654.645807][T12869] ? rt_spin_unlock+0x157/0x200 [ 654.645837][T12869] ? rt_spin_unlock+0x163/0x200 [ 654.645864][T12869] do_group_exit+0x22d/0x2f0 [ 654.645889][T12869] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 654.645917][T12869] __x64_sys_exit_group+0x3f/0x40 [ 654.645939][T12869] x64_sys_call+0x221a/0x2240 [ 654.645962][T12869] do_syscall_64+0x174/0x580 [ 654.646012][T12869] ? trace_irq_disable+0x3b/0x140 [ 654.646037][T12869] ? clear_bhb_loop+0x40/0x90 [ 654.646066][T12869] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 654.646091][T12869] RIP: 0033:0x7f2d52dce019 [ 654.646113][T12869] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 654.646134][T12869] RSP: 002b:00007fff6c9f8148 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7 [ 654.646159][T12869] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f2d52dce019 [ 654.646176][T12869] RDX: 00007f2d52029000 RSI: 0000000000000000 RDI: 0000000000000000 [ 654.646193][T12869] RBP: 00007fff6c9f81ac R08: 0000000000000000 R09: 00000000000927c0 [ 654.646209][T12869] R10: 0000000000000000 R11: 0000000000000246 R12: 000000000000018f [ 654.646224][T12869] R13: 00000000000927c0 R14: 000000000009ef23 R15: 00007fff6c9f8200 [ 654.647420][T12869] [ 654.647437][T12869] Kernel panic - not syncing: kernel: panic_on_warn set ... [ 654.647460][T12869] CPU: 1 UID: 0 PID: 12869 Comm: syz.3.2454 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 654.647503][T12869] Tainted: [L]=SOFTLOCKUP [ 654.647513][T12869] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 654.647527][T12869] Call Trace: [ 654.647538][T12869] [ 654.647548][T12869] vpanic+0x56c/0xa60 [ 654.647577][T12869] ? __pfx__printk+0x10/0x10 [ 654.647618][T12869] ? __pfx_vpanic+0x10/0x10 [ 654.647639][T12869] ? is_bpf_text_address+0x292/0x2b0 [ 654.647667][T12869] ? is_bpf_text_address+0x26/0x2b0 [ 654.647705][T12869] panic+0xc5/0xd0 [ 654.647727][T12869] ? __pfx_panic+0x10/0x10 [ 654.647788][T12869] __warn+0x315/0x4c0 [ 654.647810][T12869] ? kcov_task_exit+0x181/0x240 [ 654.647852][T12869] ? kcov_task_exit+0x181/0x240 [ 654.647888][T12869] __report_bug+0x276/0x570 [ 654.648034][T12869] ? __lock_acquire+0x683/0x2ce0 [ 654.648064][T12869] ? kcov_task_exit+0x181/0x240 [ 654.648104][T12869] ? __pfx___report_bug+0x10/0x10 [ 654.648153][T12869] ? __pfx_rtlock_slowlock_locked+0x10/0x10 [ 654.648184][T12869] ? rt_spin_lock+0x1e0/0x400 [ 654.648209][T12869] ? rt_spin_lock+0x1e0/0x400 [ 654.648235][T12869] ? kcov_task_exit+0x181/0x240 [ 654.648270][T12869] report_bug+0x16a/0x220 [ 654.648301][T12869] ? kcov_task_exit+0x181/0x240 [ 654.648334][T12869] ? kcov_task_exit+0x183/0x240 [ 654.648367][T12869] handle_bug+0x9c/0x200 [ 654.648403][T12869] exc_invalid_op+0x1a/0x50 [ 654.648436][T12869] asm_exc_invalid_op+0x1a/0x20 [ 654.648458][T12869] RIP: 0010:kcov_task_exit+0x181/0x240 [ 654.648503][T12869] Code: 90 00 00 00 e8 e0 d2 57 00 4c 89 f7 5b 41 5e 41 5f e9 c3 92 5d 00 7c 40 5b 41 5e 41 5f e9 97 5b 82 09 cc 90 0f 0b 90 eb 10 90 <0f> 0b 90 eb 0a 90 0f 0b 90 eb 04 90 0f 0b 90 4c 89 ff 5b 41 5e 41 [ 654.648524][T12869] RSP: 0018:ffffc90003c37d20 EFLAGS: 00010287 [ 654.648546][T12869] RAX: c5c8489df35a3d00 RBX: ffff88802d6c5d00 RCX: 0000000000000000 [ 654.648564][T12869] RDX: 00000000e8f3d702 RSI: ffffffff8bca7860 RDI: 00000000ffffffff [ 654.648582][T12869] RBP: ffffc90003c37e80 R08: ffffffff8b46cb20 R09: 0000000000000000 [ 654.648599][T12869] R10: 0000000000000000 R11: ffffffff8e1c3000 R12: 0000000000000000 [ 654.648615][T12869] R13: ffff88802d6c5d00 R14: ffff88801e289000 R15: ffff88801e289008 [ 654.648642][T12869] ? rt_spin_lock+0x1e0/0x400 [ 654.648676][T12869] do_exit+0x159/0x2360 [ 654.648696][T12869] ? _raw_spin_unlock_irqrestore+0x4c/0x80 [ 654.648728][T12869] ? rt_mutex_slowunlock+0x4ee/0xa20 [ 654.648755][T12869] ? reacquire_held_locks+0x104/0x190 [ 654.648786][T12869] ? __pfx_do_exit+0x10/0x10 [ 654.648828][T12869] ? rt_spin_unlock+0x157/0x200 [ 654.648857][T12869] ? rt_spin_unlock+0x163/0x200 [ 654.648884][T12869] do_group_exit+0x22d/0x2f0 [ 654.648909][T12869] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 654.648934][T12869] __x64_sys_exit_group+0x3f/0x40 [ 654.648957][T12869] x64_sys_call+0x221a/0x2240 [ 654.649000][T12869] do_syscall_64+0x174/0x580 [ 654.649044][T12869] ? trace_irq_disable+0x3b/0x140 [ 654.649066][T12869] ? clear_bhb_loop+0x40/0x90 [ 654.649095][T12869] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 654.649117][T12869] RIP: 0033:0x7f2d52dce019 [ 654.649139][T12869] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 654.649159][T12869] RSP: 002b:00007fff6c9f8148 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7 [ 654.649183][T12869] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f2d52dce019 [ 654.649219][T12869] RDX: 00007f2d52029000 RSI: 0000000000000000 RDI: 0000000000000000 [ 654.649234][T12869] RBP: 00007fff6c9f81ac R08: 0000000000000000 R09: 00000000000927c0 [ 654.649252][T12869] R10: 0000000000000000 R11: 0000000000000246 R12: 000000000000018f [ 654.649267][T12869] R13: 00000000000927c0 R14: 000000000009ef23 R15: 00007fff6c9f8200 [ 654.649304][T12869] [ 654.649916][T12869] Kernel Offset: disabled